Slashdot is powered by your submissions, so send in your scoop


Forgot your password?
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×

Are Background Checks Necessary For IT Workers? 402

4foot10 writes "UBS PaineWebber learned a hard lesson after hiring an IT systems admin without conducting a background check. Now its ex-employee is slated to be sentenced for launching a 'logic bomb' in UBS' computer systems that crashed 2,000 of the company's servers and left 17,000 brokers unable to make trades."
This discussion has been archived. No new comments can be posted.

Are Background Checks Necessary For IT Workers?

Comments Filter:
  • by Anonymous Coward on Thursday December 07, 2006 @08:18PM (#17155514)
    "What do you know about your own people?" asks Alan Paller, director of research at the SANS Institute, a security firm. ...nuff said.
  • by Bryansix ( 761547 ) on Thursday December 07, 2006 @08:21PM (#17155556) Homepage
    Would you like your email to be read by someone you don't even know? Well that is what could happen if you hire a SysAdmin and do not conduct a background check. I know that I would actually prefer if my name was run through a background check so that management can actually trust me instead of always wondering.
    • by paeanblack ( 191171 ) on Thursday December 07, 2006 @08:33PM (#17155750)
      Employer-run background checks are not the way to go here. Just get your workers bonded for some amount of money commensurate with the damage they can cause. Bonding agencies have been around for centuries and have experience in this field that the typical firm's HR department does not.

      Basically, you pay $smallnum, and if $guywithaccess does $badthing, you get paid $bignum to cover your expenses. Let someone guess the odds.
      • Re: (Score:2, Informative)

        No. I have enough insurances I have to pay for.
        • by Sj0 ( 472011 ) on Friday December 08, 2006 @01:32AM (#17158654) Journal
          How many people, at what cost per hour, for how many hours, will you use to do the background check? What agencies or companies will require what fees for information? How long will you have to wait for the check to be completed, and how will the vacancy you're trying to fill affect your bottom line during the duration of the check?

          That's your cost for option A.

          How much is the bonding service?

          That's your cost for option B.

          Whether you like it or not, you're paying for insurance either way. The question is which cost is greater, and which provides the greater effective insurance.
      • by daeg ( 828071 ) on Thursday December 07, 2006 @11:04PM (#17157442)
        The amounts of money required to cover some disasters are astronomical, and even then, money alone cannot solve the damage.

        If one of your system admins, say, sells a database of 2 million social security numbers, how much is that worth?

        Ideally, it would a be a mix of the two systems. Some positions do require security and background checks. Bond them, too -- the security check should lower the cost to bond them (and in a high-bond instance, the bonding company would likely do their own background check anyway).
    • by misleb ( 129952 )
      Doesn't take a criminal to be nosy.

    • by grcumb ( 781340 ) on Thursday December 07, 2006 @08:40PM (#17155870) Homepage Journal
      Would you like your email to be read by someone you don't even know? Well that is what could happen if you hire a SysAdmin and do not conduct a background check.

      You're not making the argument for background checks; you're making the argument for secure systems that don't allow untrustworthy cowboys to peek at others' mail without supervision.

      If someone could prove to me that background checks actually serve any other purpose than to cow potential employees, I'd be willing to consider that there might be some use for them. As things stand, I think they're a silly and - here's the important part - ineffective means of establishing security in business.

      Invest some trust in your employees. Verify that the trust is deserved. Punish breaches of trust.

      • by couchslug ( 175151 ) on Thursday December 07, 2006 @08:46PM (#17155954)
        A background check could filter out a lot of bad people.

        From TFA:

        "According to Dawn Cappelli, a senior member at Carnegie Mellon University's Computer Emergency Response Team, a 2006 study showed that 30% of insiders who are caught launching an attack against their employers have arrest records, and that those charges don't generally include computer crimes. Some 18% were for violent offenses such as rape and manslaughter, 11% were for alcohol- and drug-related offenses, and another 11% were for theft."

        Coupling background checks with secure systems gets the benefits of both.
        • by gidds ( 56397 ) <> on Thursday December 07, 2006 @09:22PM (#17156448) Homepage
          Those figures mean absolutely nothing without corresponding figures from good employees.

          If exactly 0% of good employees have arrest records, then an arrest record would be a pretty good indicator of malicious intent; while it wouldn't allow you to catch the other 70% of baddies, it would give you pretty conclusive evidence against that 30%.

          If, on the other hand, the records for good employees were the same (which I suspect is closer to the truth), then an arrest record (or lack of one) would tell you absolutely nothing about an employee's trustworthiness.

          And if the records for good employees were generally higher than for bad ones, then an arrest record would be an indicator in FAVOUR of hiring, not against!

          So, worrying as those numbers might sound, they're utterly meaningless here without some context and background!

          • Re: (Score:2, Insightful)

            by timmarhy ( 659436 )
            bullshit, it doesn't filter out "bad people" it only shows the ones that have been caught. you coudl still be placing your trust in a person guilty of the worst crimes.
        • A background check could filter out a lot of bad people.

          Perhaps, but will a background check filter out a person who doesn't have a record? What happens if you piss of your sysadmin (for whatever reason)? You may get a similar situation as UBS. How is a background check going to help you there?

          If anything, a psychological profile would be the proper approach. Ask, "Does this person, with a clean record, hold the propensity to go postal (aka, rm -rf *) ?" How many people graduating with a CS or IT de
          • by vought ( 160908 ) on Friday December 08, 2006 @02:22AM (#17158966)
            If anything, a psychological profile would be the proper approach.

            And with a failure rate of about 20% (according to my headhunter) these personality tests [] keep a lot of good people out of jobs.

            But I suppose we're all supposed to prostrate in front of the almighty corporation. God forbid companies take risks or put in place mitigation strategies so that rogue employees can't bring the whole place down.

            Did they make Ken Lay take a personality test? What about Jeff Skilling? I suspect they would have been found ideal based on the types of questions on these tests - which tend to focus on attention to detail, attitude, and trust in coworkers. Yet these men ruined the livelihoods of thousands with their greed. But personality tests don't probe for greed or concern for others (at least not the ones I've taken). They're also pretty invasive, asking about a prospective employee's personal life.

            The personality test I took was at a company in Baton Rouge, Louisiana. My friends back in Silicon Valley couldn't believe some of the questions that were on the test, and would "just have walked out". But I need a job, so I took the test. It said I wasn't gregarious enough and a something of a solitary worker. So despite a director-level assurance that they wanted to hire me, the personality test made the hiring decision for them.

            Personality tests are measurements based on what companies think they want to know - and this isn't truly useful information. A "loner" might be able to accomplish more, faster, than folks who are sociable and who hang out at the coffee pot for several minutes a day, but according to the Caliper test, these people aren't good fits at most companies.

            I think that based on these simple observations, personality tests (and by extension, background checks) are less useful than they're billed as being.
    • by AnotherBlackHat ( 265897 ) on Thursday December 07, 2006 @08:43PM (#17155902) Homepage

      Would you like your email to be read by someone you don't even know? Well that is what could happen if you hire a SysAdmin and do not conduct a background check.

      So if I run a background check, my email will be read by someone I do know?

      -- Should you trust authority without question?

      • Yep. It's a catch-22 with most email systems. Especially exchange. If you have access to reset a password in exchange then you can read anyones email. There are ways around this but Microsoft didn't feel like it needed to be implemented.
    • Re: (Score:3, Funny)

      by jwarnick ( 637847 )
      I'm consulting for a 17,000 person multi-national firm. Most of the the internal infrastructure, including email, is outsourced to HP India. It is my experience that HP India is staffed by diploma mill graduates. These are the people reading your email.
      • by dave562 ( 969951 ) on Thursday December 07, 2006 @09:16PM (#17156358) Journal
        I can't speak for HP India, but as an IT consultant who keeps Exchange running for a lot of large firms I can tell you that Exchange isn't as insecure as some of the FUD here would have you believe. By default, Domain Admins are EXPLICITLY DENIED rights to users mailboxes. If you grant yourself those rights, it will be logged. For that matter, even the Exchange Administrator account is set default deny when it comes to reading other people's emails.
  • What for? There are limits to croporate paranoia. How many people are genuinely untrustworthy?
    • I propose we limit the corporate paranoia to people in a position of significant responsibility and authority inside the company... including the people with root access to the company's computer systems.
    • Re:What for? (Score:5, Informative)

      by Bryansix ( 761547 ) on Thursday December 07, 2006 @08:39PM (#17155838) Homepage
      Obviously you have never worked in the Mortgage Business. It seems like the majority of the people in this business are in it to commit some kind of fraud. Whether that fraud will cost the company money is up another story. Still you have the Loan Originators lying on applications and changing data to push loans through, you have Branch Managers accepting first payments and cashing the checks in their offshore accounts, you have people "referring" loans to get around licensing requirements. So what risk does an IT person pose in this industry? Ever heard of Identity Theft? I personally have access to the social security numbers, bank account numbers, last know addresses etc of all of the borrowers on any loans passing through here. Now I'm not stealing this information but the Secret Service actually arrested some former employees here for an ID Theft Scheme. So yes, background checks plus a process of following up and actually being aware of what your employees is up to is very important.
    • Re: (Score:2, Insightful)

      by ScentCone ( 795499 )
      How many people are genuinely untrustworthy?

      I don't know, either. And since you didn't say how many are, neither do you. But it only takes one to cost a company millions of dollars, or run them right out of business entirely. I have clients that rely utterly on their customers' sense that they handle their data securely and that the team of people who touch that data are trustworthy. One slip could ruin those customers, cost people their jobs, homes... that's a lot more expensive than a background check,
  • by susano_otter ( 123650 ) on Thursday December 07, 2006 @08:23PM (#17155590) Homepage
    Background checks are a blatant violation of our right to privacy!

    Our entire civilization will be replaced by a fascist tyranny the moment we allow background checks to happen!
  • No guarantee (Score:5, Insightful)

    by homer_ca ( 144738 ) on Thursday December 07, 2006 @08:24PM (#17155604)
    "a 2006 study showed that 30% of insiders who are caught launching an attack against their employers have arrest records, and that those charges don't generally include computer crimes."

    That means a background check won't catch 70% of the malicious insiders. This article is meaningless without info about the rates of attacks from insiders who would've passed or failed background checks. It's a reasonable hypothesis to say that IT workers with criminal records are more likely to launch insider attacks, but there's no scientific evidence of it in this article. It's all fluff based on one person's case.
    • Re:No guarantee (Score:5, Insightful)

      by DragonWriter ( 970822 ) on Thursday December 07, 2006 @08:28PM (#17155664)
      More importantly, it doesn't tell you if the 30% of "insiders" who launch attacks that have arrest records is greater or less than the proportion of people in similar positions that have arrest records to start with, and therefore if people with arrest records in are even more dangerous than others.

      • Re:No guarantee (Score:5, Insightful)

        by GigsVT ( 208848 ) on Thursday December 07, 2006 @08:32PM (#17155736) Journal
        That logic is flawed.

        Same logic: Per capita, more black people commit crimes than white people, therefore, black people are more dangerous to hire.
        • Re:No guarantee (Score:4, Insightful)

          by Anonymous Coward on Thursday December 07, 2006 @08:39PM (#17155842)
          Where's the flaw part?
          • Re:No guarantee (Score:5, Insightful)

            by ObsessiveMathsFreak ( 773371 ) <obsessivemathsfreak.eircom@net> on Friday December 08, 2006 @10:13AM (#17161526) Homepage Journal
            Where's the flaw part?
            An obvious troll,(modded up why...?) but I'll bite. Let's look at the GPs statement again.

            That logic is flawed.

            Same logic: Per capita, more black people commit crimes than white people, therefore, black people are more dangerous to hire.

            Where's the flaw part?

            This is an obvious fallacy based on what I like to call "The Tyranny of the Random Mean". Like most statistics, the GPs statement is valid, when based on a certain "population". In this case, the entire population of black people, in I presume the USA. And certainly it would be true that, on average, on average, if you selected at random 100 black people from the entire black population in the US, and the same for 100 white people, then the total sum of criminal convictions would probably be higher for the former group. Please note the italised and emboldened words in the above. They are very, very important.

            Now, you're conducting a job interview, where the interviewees' skin colours vary. You are concerned about security and you have the above statistic in front of you. The sad fact of life is, most people will read the above and conclude that security-wise, a white person is a safer bet. They weren't. Or that is to say, the above statistic is of no use in telling you whether they are or not. Here's why.

            Firstly, statistics is based largely on the fact that when the number of samples from the population is large, say ~100, then general population statistics are applicable. If the sample is, say, one or two, population statistics is of little to no use.

            Secondly, and more importantly, your sample is no longer random. N.B. N.B. N.B. !!!!

            I'll say that again, in case you missed it.

            Your sample is no longer random .

            The entire premise of statistics is that you randomly select individuals from the population. Statisticians stay up at night worrying themselves over how to do this, and are even more obsessive about their random number quality that a /dev/urandom geek. If your selection from the population is not random, then the statistics will be totally misleading.

            You're at a job interview for a specific IT position, yet you want to use a population wide statistic for the entire population in this situation. You're basically assumming that all; qualified, black, geeks, applying for a job at your company, in your town, at this time, is a valid random selection from the entire black population of the United States. Congradulations. You just failed Data Analysis 101.

            If you want to actually apply a statistic validly, again, you need to have a random sample, from the right population. In a job interview, you're never going to have a random sample. It may or may not be quasi random, but even it if was, you'd need a statistic for all contemporary, qualified, black, geeks, probably in your region. If you had that, then you might be justified in applying a statistic, but in reality, with such a small sample size (likely just one guy), the noise would be so high you're just wsting your time.

            Instead of trolling for pretty useless statistics and data, companies should just hire based on merit. Take candidates, look them up and down, decide if they personally are the best person for the job. "Normal" is a statistic. Human beings are not homogeneous, they are all different, they all have strengths and weaknesses. If you base your hiring practicies on the averages, then you'll end up with average employees. Mediocre, jacks of all trades who are neither excellent or terrible at anything. And your company too will be as average as they come.
    • by cshark ( 673578 )
      I can't speak for anyone else, but I've never had an IT job where a background and drug test were not required, and I've been at this for awhile. What about the attacks from people on the inside that have no record. Does that factor in at all, or do we not care about it for the sake of argument?
      • You must work for big boring companies or defense contractor types.

        I too, have been at this for a while. The ONLY place that did a drug screen was for "the phone company". Gah! the clock-punchers there could have used some drugs, IMHO.

        Over my career, I've had my fingers on the button for "big money" financial types, military stuff, and other things. Right now I have VPN access to various companies where I could, if I were of a mind to, make some "adjustments" to content that would probably find their wa

  • by Anonymous Coward on Thursday December 07, 2006 @08:24PM (#17155612)
    But for this case, they had bigger problems.

    No organization that large should technolgically empower a single person to be able to do that much damage without some sort of review process that would have caught the problem.

    Did his changes get reviewed by his peers?

    Did they go through some sort of QA process?

    While it's a bit scary that they hired a criminal, that's hard to avoid in any large organization.

    What's really *really* scary is that their internal processes let him do that much damage. I'd be worried if I were their customer.

    • by volpe ( 58112 )
      This would work quite well so long as your server is locked in a room where two sysadmins need to turn their keys simultaneously to get in.
    • Re: (Score:3, Insightful)

      by teal_ ( 53392 )
      While it's a bit scary that they hired a criminal

      That's not fair. This person has presumably been punished for their crime(s) and paid their debt to society, it's unfair to blacklist him for the rest of his life.
    • Re: (Score:3, Interesting)

      No organization that large should technolgically empower a single person to be able to do that much damage without some sort of review process that would have caught the problem.

      I just started working at a bank, and I learned of (what I thought was) an interesting security measure. There are several banking activities that cannot be completed by a single person. For example, I am allowed to create or authorize a wire, but I cannot do both to a single wire. There would have to be a conspiracy of two peopl

  • by DragonWriter ( 970822 ) on Thursday December 07, 2006 @08:25PM (#17155620)
    Sure, he had a criminal record with offenses 20 to nearly 40 years prior to the time he was hired. I don't see that that's a real indication that he is likely to lauch a "logic bomb".

    I've certainly heard plenty of stories about disgruntled IT workers in sensitive positions doing things like that—usually a criminal history isn't mentioned. Is there any evidence that there is a correlation between that and long-past criminal convictions that aren't closely related to the kind of damage they later do?

    Or is this just a case of "Ooh, something bad happened, lets look for something about the person that might explain it, and then assume that this proves the general utility of background checks"?
    • Re: (Score:3, Insightful)

      by mikelieman ( 35628 )
      psst. There's an entire industry built around pre-employment background checks and screenings.

      Anything for a buck...

    • by JimBobJoe ( 2758 ) <swiftheart AT gmail DOT com> on Thursday December 07, 2006 @10:17PM (#17157032)
      Is there any evidence that there is a correlation between that and long-past criminal convictions that aren't closely related to the kind of damage they later do?

      I do background checks for a living.

      I wouldn't go as far to say that it's snake oil, but I definitely think it's oversold by so-called security types.

      I think they are most useful in predicting some types of violent behavior. In my experience, an individual who gets charged and convicted with domestic violence in their 50s almost always has a dozen speeding tickets, a criminal trespass conviction and maybe a disorderly conduct charge for good measure. Background checks might be useful to predict this type of potential behavior.

      On the other hand, people who commit murder or sexual offenses (whether it's in their 20s, 30s, 40s or 50s) won't even have a parking ticket in their name. I feel like they just snap one day. So in this regard, background checks are worthless.

      Theft and burglury and related charges are 95% of the time committed by those under 25. It just doesn't come up later in life. Background checks can be misleading in this regard.

      Background checks that go back 30 or 40 years are pretty expensive (as noted in the article) and unusual. If you did your crime in the 70s I'm guaranteed not to find it.

      My biggest issue is that background checks are hugely dependent on our judicial system, which doesn't operate as "cleanly" as the credit rating system, but for some reason, is treated as if it did.

      Money used in defense plays a huge role in things. An extra grand or two on a lawyer might very well be the difference between being offered a plea bargain to misdemeanor 1 Theft, and being offered a plea bargain to misdemeanor 4 unauthorized use of property with the prosecutor agreeing to expunge the case in a year. (Whereas the credit rating system keeps all the records out there, what keeps criminal records around in the judicial system might have very little to do with the crime perpetrated.

      How the state legislature enacted laws plays a huge role, though one the security companies like to dismiss. For instance, my state of Ohio has probably the nation's most liberal marijuana possession laws--anything under 100g is a minor misdemeanor, maximum fine $100--and no public record.. In quite a lot of states the same posession is a high level misdemeanor with jail time and obviously, a public record.

      Does that mean that two people who've been cited for marijuana possession (same quantity), one in a state like Ohio with no public record, and another in a state with a public record will be treated very differently by companies because of their records? Absolutely. But that neither strikes me as fair or particularly logical--after all, the companies nor the security firms really ever sit down and realize that they are dependent on the state for the information--and that different laws in different states cause different information outcomes. They just use whatever information they have against the job candidate.
  • Do a cost/benefit analysis. If you're a small computer repair shop with 5 employees, then it's probably a waste of your limited funds to do a background check, especially if doing so delays the hiring process. You'll be keeping close enough supervision to catch any egregious acts anyway. If the employee is going to have root access to 10,000 computers, then maybe a thorough background check is in order.
  • The only thing a background check really proves is that a person has not been caught at anything yet. It's the ones that get away with nefarious actions that you really have to worry about (Note, I'm not one of those nefarious people, though I'm sure someone will bring that up).
  • by AK Marc ( 707885 ) on Thursday December 07, 2006 @08:28PM (#17155670)
    Prosecutors charged that Duronio, angry over not receiving as large a bonus as he had expected, sought revenge against his employer [... who] spent about $3.1 million to assess the damages and restore the computer systems, [... and] haven't reported how much was lost in business downtime.

    In retrospect, it appears that the entire event, as well as the financial damages and the hit to the company's reputation, could've been avoided if UBS PaineWebber, a giant in the financial community, had done a background check on Duronio when he had been hired.

    And I see the problem as being caused by a lack of bonuses in IT. Prevent logic bombs, give your IT workers large bonuses!

    (I'm talking to you, boss)
  • I think it depends on the business you're in, since that level of distrust isn't necessary in every organization. Anyone in a position of trust can eventually escalate their privileges, unless you have extremely strict access controls.

    Ultimately, the guy did it because he didn't get a big enough bonus. His sour grapes = fucked company.

    IMO, if you're going to run background checks, it isn't enough to just scan the critical (IT) guys. If you aren't checking everyone who could be a potential threat, then it's
  • I've always been under the assumption that, given proper preparation and time, a high-level IT guy with good enough access could repeat everything that happened in the Enron scandal. As of now, most incidents I've heard of seem to be just one guy trying to nail a company that angered him, but it's only a matter of time before someone decides to milk a company for all it's worth (or maybe it's happened and I just haven't heard about it). Preventing that sort of thing would probably be a good idea, to say t
  • by k4 ( 267349 ) on Thursday December 07, 2006 @08:33PM (#17155754)
    Yes, of course admins with the ability to wreak major havoc at an organization should have to undergo background checks. Several years ago I worked at a Fortune 500 company, and there were no background checks done at all for IT staff. Turns out we hired a guy who used a fake name and someone else's social security number, and he worked as one of our main sysadmins for over a year, with privileges on probably 100 servers and full privileges on the email servers, before he was caught. I thought background checks were a waste of time until that...scared me half to death because no one had any idea what he'd done in all that time, and worse, no idea who he actually was.
    • by hackstraw ( 262471 ) * on Friday December 08, 2006 @10:14AM (#17161538)
      Turns out we hired a guy who used a fake name and someone else's social security number, and he worked as one of our main sysadmins for over a year...

      Hmm, so I would assume he picked a clean SSN and name, so a background check would have revealed???

      There is a place that has 441 employees, and here is the breakdown of their past:

      * 29 members have been accused of spousal abuse.
      * 7 have been arrested for fraud.
      * 19 have been accused of writing bad checks.
      * 117 have bankrupted at least two businesses.
      * 3 have been arrested for assault.
      * 71 have credit reports so bad they can't qualify for a credit card.
      * 14 have been arrested on drug-related charges.
      * 8 have been arrested for shoplifting.
      * 21 are current defendants in lawsuits.

      * And in 1998 alone, 84 were stopped for drunk driving, but released after they claimed Congressional immunity.

      Yes, thats congress.

  • Sorry for that. The story mentions that this person had prior convictions for minor crimes on his record when he was hired. They didn't run a background check on him before they put him in control of over 2,000 servers. Then they screwed him on his bonus and he screwed them. Now he's going to jail.

    It sounds to me like their HR department was incompetent, the management was incompetent and they gave an employee too much control. I don't think any one employee should have that much control over a company's I
    • Do you not understand the concept of a bonus? It's a gift, you can't get "screwed" on it, and TFA only says that it was his opinion he didn't get what he "deserved".
  • First Offence?? (Score:2, Interesting)

    by number17 ( 952777 )
    How would this ever prevent a first offense??
  • by michael.j.jarvis ( 969145 ) on Thursday December 07, 2006 @08:35PM (#17155770)
    This is something that has affected me in the past year, while trying to get a job in the industry. I can completely understand background and credit checks, but at the same time, many perspective employers do not even give me a chance to explain myself, or the reason things came up. Granted, I'm only 24, and people see me as some damn kid who wants to show off to his friends, but that is completely opposite of what I'm there to do. I can understand that perspective employers see several arrests as a juvenile, and I'm instantaneously blacklisted. My credit has gone to shit too, especially after a messy divorce that has drug on for way too long.
    Ok, so I know I'm going to get modded down on this, but it's something that is really never spoken about. True, it can affect the job search for many of us, but I support having background checks, on the condition that we the person being investigated be offered a chance to explain ourselves, and to not become prospective employee investigation # 54283. /end rant
    • by mythosaz ( 572040 ) on Thursday December 07, 2006 @08:56PM (#17156078)
      I hate to burst your bubble, but here's the reality. You, at 24, probably have a similar knowledgebase and skillset as other applicants for my positions. Since I run a background and credit check against my future employees, I get to pick between someone with the same skills as you and a "clean" record, or you with bad credit, a divorce and and a criminal record. Guess who I'm hiring.

      Unfair? No. You're not the sort of person I want working for me. You don't have a stable family life. As such you're more likely to quit/move and give shorter notice when you do. You have bad credit. You haven't demonstrated (regardless of good or bad reasons) to large financial institutions that you're worth loaning money to. I'm less likely to want to give you access to mine. Finally, you're a criminal. Sure, you were a criminal when you were a kid, but, on paper, you're more likely to be a criminal in the future, and that's nothing my company wants anything to do with.

      On the other hand, if you've got a great resume, and you stand out, and it's not a tiebreak, we might overlook SOME of those problems.

      I sympathize. I have a divorce. Until recently I had bad credit. I got in trouble as a young adult and have a misdemeanor record (reduced felony). I know if I didn't have the skills I do in my special niche of the IT world, I'd be passed over in favor of others. Thems the breaks. It's the price I pay for the mistakes in my youth.
      • Re: (Score:2, Interesting)

        Yes, I can understand the whole not wanting to hire me because of things in my past. The thing is, is that as I get older, things will start to work out for me. I've settled down quite a bit, and I do have much more stability in my life now than I did two years ago. I learned that in 6 years in IT, nothing comes fast. I don't expect to be a Senior Sys Admin when I'm 26. Maybe when I'm 36 or so, but not now. I'm in a great job as a Jr Level AD/Exchange Admin. I'm happy, I'm learning more each and every day t
  • Yes everyone should get a background check right from gas station clerk to CIO, and everyone should have to pee in a bottle, and submit to intrusive personal "psychological profile" questions, because the health of the collective is more important than individual rights, right? This is EXACTLY thee mindset of communism, and don't even try to tell me that you have a choice to work for a firm or not, if they all require background checks, peeing in a bottle, intrusive psychological tests, etc, then we have d
    • It's funny how the only aspects of communism widely being adopted are the aspects Marx saw as at best transitional.
  • This is funny (Score:4, Insightful)

    by RelliK ( 4466 ) on Thursday December 07, 2006 @08:38PM (#17155828)
    It seems that the croud here decries criminal background checks as useless or even counter-productive. And yet this is the same croud that villifies Diebold for hiring criminals. Go figure...
    • Re: (Score:3, Insightful)

      It seems that the croud here decries criminal background checks as useless or even counter-productive. And yet this is the same croud that villifies Diebold for hiring criminals.
      Not really. Some of this crowd decries criminal background checks, and some of this crowd villifies Diebold for hiring criminals.

      You're underestimating just how huge this crowd is.

    • Re: (Score:3, Funny)

      by jesdynf ( 42915 )
      Hey, everybody, help me out here -- is there a specific logical fallacy that covers this, or do we need to make a new one?

      If we do, then I'm going to formally recommend we entitle the fallacy of assuming one snapshot of a vocal fragment of a pseudoanonymous userbase represents the beliefs of every such member, and can be compared to other such snapshots without limit, the "Damn You, User #4466" logical fallacy.

      So, back to you, RelliK. You say that Slashdot lambasted Diebold for hiring criminals, then lambas
      • by Sj0 ( 472011 ) on Friday December 08, 2006 @01:56AM (#17158814) Journal
        Make up your mind, Anonymous Coward, is Bush the heroic liberator who brought us into our mighty victory of morality and justice and law in Iraq and in so doing struck a blow against terrorism, or is Bush the cowardly army deserter who brought us an illegal, immoral war against a red herring of a irrelevant despot in the middle of the war on terror?

        God, you're so hypocritical sometimes! It's like you're arguing with yourself!
  • True Story... (Score:4, Insightful)

    by MadMorf ( 118601 ) on Thursday December 07, 2006 @08:40PM (#17155856) Homepage Journal
    A company I worked for in the 90's discovered it's night-shift word processing supervisor was a convicted felon when conducting background checks on a couple dozen employees, after wallets and purses started disappearing from the office near Christmas time...

    The WP supervisor had worked for another company and copied a database onto floppies and then erased the production database. He tried to hold the data for ransom, but the company just had him arrested. He did a couple of years in the klink and when he got out he went to work in the billing department of a local utility where he deposited customer payments into his own account. He did a couple years for that as well...He had worked for our company for 2 or 3 months, virtually unsupervised.

    The wallet thief turned out to be a mailroom guy who had worked there for years...
  • How many others do the logic bomb or other white collar crimes who don't have a record of burglary and aggravated assault?
    What was Ken Starr's background? Murder?

    The most dangerous ones are the ones who come back empty. Sucks when this happens, and a background check wouldn't have hurt, but you gotta watch your people closely and hope for the best. IT is very dangerous, aggravated assault or not, you can easily get screwed over.
  • Absolutely (Score:4, Insightful)

    by iamacat ( 583406 ) on Thursday December 07, 2006 @08:41PM (#17155876)
    Companies should start by doing a background check of their CEOs and promptly fire them if any irregularities like a previous arrest or drug/alchohol violations are found []. Once the people who could really do a lot of damage, like violate US/EU business laws, are investigated and dismissed, the company will be justified in asking rank and file to give up their privacy.
  • It's UBS' Fault (Score:2, Interesting)

    The question you should be asking is not, "would a background check have prevented this", it's "how the hell could one person alone cause that much damage on UBS' network"?

    One person should not have been able to push a logic bomb out to thousands of machines without several other people in the organization knowing about it. Isn't UBS publicly traded? The Sarbanes-Oxley Act should have required that their IT group be audited to ensure that controls were in place to prevent exactly this sort of situation

    • The Sarbanes-Oxley Act wasn't passed until July 30, 2002, and its focus was an entirely different issue.
  • by Christopher_Edwardz ( 1036954 ) on Thursday December 07, 2006 @08:45PM (#17155946)

    How would burglary and assault (um... 47 YEARS AGO) lead to logic bombs? (From the OP) How would this have helped?

    From the article:

    Using only publicly available information, Hershman found three incidents, including drug-related charges from 1980 and a tax violation, within 24 hours. Within three or four days, he says investigators found information on a conviction and incarceration from the early 1960s related to aggravated assault and burglary charges. A presentencing[sic] report from the Probation Office in U.S. District Court also lists charges against Duronio from the 1960s, 1970s, 1980s, and 1990s.

    So... basically, 27 years ago this guy had a drug case, and more than 40 years ago had an aggravated assault and burglary charge. From this they were supposed to deduce that this guy was going to logic bomb them?

    Or, according to TFA and Hershman, this would've been enough for them not to hire him at all or just for computer work? He doesn't say. I've worked in firms that would refuse to hire you if you had anything on your record.

    Please note here that Mr. Hershman sells this service and I am not so sure that he would be considered unbiased.

    Here is some guy that would have been penalized for something he did 40 years ago?

    Talk about 2nd class citizens. Do they understand that over 2% of the population is in prison and a considerable portion of people living today have been in prison or convicted of some offense at one point or another?

    One of the engineers I hired had a drug conviction, but it was clear that she was recovering and this was a good opportunity for her. That was several years ago. Do I feel bad about that? Of course not.

    I understand why companies feel the need to do criminal background checks to absolve themselves of a possible lawsuit. (They are culpable if they hire an ax-murderer just released from prison and he axifies some people.)

    I believe that some of this is designed to find a chink to break down an employee so he/she will accept less in salary.

    "Hmm... you have bad credit. Oh look, you also have some speeding tickets. Now, how much did you say you wanted for the privilege of working here?"

    Criminal background checks should be used judiciously in sensitive positions. IT is probably one of those... but companies shouldn't just rubber-stamp anyone with a conviction a "no hire".

    • Here is some guy that would have been penalized for something he did 40 years ago?

      More to the point, this is some guy who hasn't been arrested in 25 years and has apparently been productive for the majority of that time (dunno if he got prison or for how long). This isn't really the sort of thing you have to worry about usually, although sysadmin at a brokerage is perhaps not the best place.

      Talk about 2nd class citizens. Do they understand that over 2% of the population is in prison and a considerable

    • by Qzukk ( 229616 )
      (They are culpable if they hire an ax-murderer just released from prison and he axifies some people.)

    • Did you read your own post? charges against Duronio from the 1960s, 1970s, 1980s, and 1990s. That's a lifetime history of bad behavior. And burglary, although long ago, indicates a severe character defect.
  • Prosecutors charged that Duronio, angry over not receiving as large a bonus as he had expected, sought revenge against his employer by building, planting, and disseminating the logic bomb. It was designed to delete all the files in the host server in the company's central data center and in every server in every U.S. branch office.

    Duronio aka Clark Griswold?
  • by Gothmolly ( 148874 ) on Thursday December 07, 2006 @08:48PM (#17155974)
    I have never been arrested for anything, what's to prevent me from doing something malicious? If I do, is my employer at fault for not checking me?

    Background checks catch the stupid criminals.
  • No, seriously. I have worked as a security consultant for financial firms; I have been an IT admin for brick-and-mortar shops who cared more about production line breakdowns than integrated, SQL-based inventory controls. This decision will be a result of each company taking a long, hard look at risk management, not some company who wants to use background check to make lives miserable for its applicants.

    To wit, I was called into a local electric utility company to do a risk assessment after one of its ex-
  • by bigmaddog ( 184845 ) on Thursday December 07, 2006 @09:02PM (#17156158)
    The article is just fearmongering. Aside from the questionable use of statistics that others pointed out [], many of the choice quotes are from sources that are hardly objective, such as "Howard Schmidt, a former White House security adviser and now president and CEO of R&H Security Consulting" or a a "Ken van Wyk, principal consultant with KRvW Associates," which, you guessed it, is a security consulting firm []. It's like asking a telemarketer if he thinks you need a new long distance plan. Of course these people are going to tell you everyone's out to get you and they have the answer, all based on the strength of one horrific case study! Sure, you need to check up on people with, as they put it, the keys to your kingdom, but the analysis in TFA is hardly a basis for a level-headed, thoughtful discussion.
  • If he lied on his application, a good background check will reveal this. This goes for all employees, from the guy who mops the floors to the guy in the CEO's office. Remember, the guy you hire to mop the floor may be working on his CS degree and become your IT guy in 3 years. 15 years later he may be the CEO.

    Catching a liar is much more valuable than disqualifying a murderer or embezzler. The former obviously hasn't learned his lesson yet.

    As for protecting your systems from bad acts, keep audit trails.
  • was supposed to include a red swingline!
  • Come on now (Score:2, Funny)

    by t00le ( 136364 )
    Where will I be able to buy my weed from if they find out our BOFH has a cultivation of marijuana arrest twenty years ago?
  • by xjmrufinix ( 1022551 ) on Thursday December 07, 2006 @09:09PM (#17156280)
    I think the label of criminal is kind of being tossed around like a kind of boogie man, some clearly designated type of human who is scientifically proven to be more prone (if not certain) to steal and destroy the property of anyone fooled into hiring them. I don't think this has any basis in reality, and background checks serve more as PR and a way to placate the public into a false sense of safety than anything else. In reality, every workplace I've ever seen, technical or otherwise, was full of "criminals" who had never been caught and for whom background checks would provide zero protection. Humans are quite often greedy and selfish and inclined towards breaking rules when they think they can get away with it. I've had bosses who used background checks to screen employees while they themselves would steal hardware from the office. I wonder how many (much less sensational stories) of IT workers without criminal histories stealing from their employers aren't being reported... I personally have a criminal record, dating back to my teenage years, and am now in my late twenties. I understand an employer's apprehension when considering me for a job, even after all these years of living a constructive life, but I believe the roots of that apprehension are manufactured by the media. In reality, it is a huge task for an ex-offender to go to school and even develop the qualifications for IT work, and in my personal experience and from volunteering to help employ other ex-offenders, I believe someone who has invested that amount of effort into pursuing that career is far less likely to throw it away by doing something stupid. Most active criminals/addicts can't hold it together enough to get through college and perform the duties expected of an IT worker. They don't invest huge amounts of effort and time playing it straight for years so they can infiltrate companies and ruin everything. This character seems like an aberration to me.
  • But don't let that be the only means. When hiring someone in a security sensitive position, do a LOT of little interviews. Take him to lunch a couple of times. Get various people to interview him in their own ways and have them report back their "feelings of trust." Check references with more than a phone call. Take THOSE people out to lunch too.

    You might end up buying a lot of lunch, but what you want to know is what is this person REALLY like and that takes personal interaction. His "first offense"
  • it used to be the background check was called "checking references", and was done by the manager or HR. Previous employers were contacted, and if there were bad vibes, the candidate was passed over. This would tell a company far more than background checks.
  • Always check (Score:3, Informative)

    by Billly Gates ( 198444 ) on Thursday December 07, 2006 @09:37PM (#17156618) Journal
    I have a family relative who is a senior HR executive and you would not believe the stuff she sees. The vast majority of people lie with degrees and experience and many have criminal backgrounds. More than half plainly lie or use family members as references. People who were once criminals have trouble finding jobs and are very likely to keep applying until someone doesn't notice. They make up a very large majority of desperate applicants with false resumes.

    She ends up firing quite often over this
  • by CharlieG ( 34950 ) on Friday December 08, 2006 @09:21AM (#17160922) Homepage
    I've worked for a LOT of places - some were banks. My wife works for a brokerage. Trust me, for every one of those jobs, we not only had a regular background check, but were fingerprinted, and the prints run

    They actually called my wife back on one of them - at out old house, there was a woman with the same name 1 block away, so our addresses were 1 digit different. That woman had "problems". This has actually turned up 2-3 times, including at our house closing - we had to certify that my wife was NOT the other woman - they took our word, but had to sign a paper

    I've held security clearences - they don't prove that you won't do something wrong too - BUT they do tend to get rid of SOME of the chaff - yeah, you lose some wheat too, but...
  • by hey! ( 33014 ) on Friday December 08, 2006 @10:14AM (#17161534) Homepage Journal
    The kind of background checks that were done 20 years ago wouldn't be a problem. A credit report (which by law you can obtain and correct), criminal convictions, that sort of thing. Pretty much everything comes out of public or quasi-public records.

    These days, companies like ChoicePoint are offering data products mined from a wide array of sources. There are many problems with this approach, starting with the fact you did not consent for people to share your data for this purpose. In the US, the Fair Credit Reporting Act supposedly regulates some information products used for this kind purpose, but there are many ways around. The same kind of information that you have a right, under FCRA, to contest and correct in a credit report can appear in a background check... and lots more.

    You have no right to know or contest what is in a background check. Particularly the cheap kind that are sold almost as shrink wrap products.

    The information on the background check can be simply wrong. I had a modem line in my house for a short time, less than two years. Possibly because I had it for a short time, the number got recycled fairly quickly after I had it disconnected. Recently I ran a background check on myself, and found data that had nothing to do with me in it. Looking at it carefully, it turned out to apply to the people who got my old modem phone number.

    What if those people had been criminals, or terrorists?

    Here's another eample. A couple of years ago, a big box store in our area went out of business. A few months before the store went belly up, we had spent $15 there. Later, we got hundreds of dollars of charges on our credit card: somebody at the store ran our credit card number through dozens of times, apparently to bring enough cash to keep it afloat for another month. We told the credit card company to decline the charges. If the information that we had hundreds of dollars of unpaid debt ever appeared on our credit report, we could challenge it. But if it appeared in a background check, we wouldn't even know.

    Even where information is correct, it might not be complete. For example, suppose the creditors in the store incident took us to court. That could appear on our background check. But if the judge dismissed the case, it might not appear in the report at all.

    Wouldn't a more accurate background check be better? Yes, but it is more expensive. The background company can sell a much cheaper product if they tolerate a lot of mis-information that shows unlucky people in a false light. The employer can tolerate false positives too, unless it is unusally important to hire the best possible person. In those cases they could double check the background check if they aren't scared off; or they could purchase a better background check. Having a selection of price/quality in background checks benefits the employer and the data companies. It's bad for everyone else.

    Background checks are a good thing. Inexpensive background checks are a good thing. Cheap (as in shoddy) background checks, which contain information you cannot see, much less contest or correct, are a very, very bad thing. At the very least, the information in the background check should be shown to you first, and you should be able to challenge it before it goes to the employer.

    A better system would work like this: somebody ought to offer a "bonded worker" product. You, as the employee, would hire a trusted and respected company to do a background check on you. The bonding company would then produce a risk profile based on the information in that background check, and show it to you. You could query various findings and view and contest the data used to arrive at them. When the report is mutually acceptable, the report would be sent to your prospective employer. If that employer had any special concerns, they would submit them to the bonding company, who would draft a response which you could review and challenge. At any time you

When all else fails, read the instructions.