7 ms·

Funny story (well OK, not so funny), I worked at a company where the FBI decided to pay a visit and investigate some potential naughtiness performed by members

by kemiller2002 7y ago

Funny story (well OK, not so funny), I worked at a company where the FBI decided to pay a visit and investigate some potential naughtiness performed by members of the senior staff. They asked questions such as "Do you use your cell phone and personal email for company matters." Guess what a lot of them said, "Yep, have to." That immediately made their personal equipment, etc. in scope for the investigation and they confiscated it. Interestingly enough, any crime discovered while in pursuit of another crime can also be prosecuted. (Guess how they leverage people to flip.) After hearing about that, I never attach anything work related to my personal equipment. There is too much liability. Anytime that anyone even whispers about me using anything I own for company use, the answer is a resounding "No." You honestly, don't know who you are really working with/for and what they are actually like.

eschneider 7y ago
Nothing focuses the mind on sensible email retention policies like working at a company where all the email got subpoenaed.
- twic 7y ago
  And since discovery processes are often leaky, pPart of the onboarding at my company is the lesson that you shouldn't write anything in an email that you wouldn't be happy to have splashed all over the Wall Street Journal. So, for example, we try to choose names for applications that aren't going to give people the wrong idea, eg don't call your market manipulation tool TurboMarketManipulator, call it EnhancedOrderManager.
  - jrockway 7y ago
    > don't call your market manipulation tool TurboMarketManipulator, call it EnhancedOrderManager Good advice. I am somewhat surprised at times on what the media doesn't uncover and try to spin as a conspiracy theory. For example, we had this open source project publically available https://gfiber.googlesource.com/kernel/prism/ https://gfiber.googlesource.com/kernel/prism/ around at the same time as the Snowden leaks about "prism" and nobody wrote any articles about it. Of course, it's completely unrelated... but I feel that that normally doesn't stop people. I found the whole thing very interesting.
  - me_again 7y ago
    "Dance like no one is watching; Email like it may one day be read aloud in a deposition" -- Olivia Nuzzi
  - lbatx 7y ago
    I realize you are being somewhat facetious, but calling your (presumably unlawful) market manipulation tool EnhancedOrderManager isn't really the answer. Not building the unlawful tool is.
OrangeMango 7y ago
If you use your home computer to RDP into your work computer, what would be the correct answer to the question? The "work" occurs on the company-owned computer, but you are typing on the keyboard of your personally-owned computer.
- ghostbrainalpha 7y ago
  That's a good question. But as long as you don't save any files on your personal computer, it is just a transport device like a car that gets you to work. I'm guessing the law isn't that forward thinking though. Maybe I should keep a <$200 mini-PC, just to RDP into work so I have no problem giving up that machine.
  - gumby 7y ago
    Clever. A modern day "dumb terminal"
    - oarsinsync 7y ago
      If you think that's clever, you'll be blown away when you see actual thin client and zero client hardware. PCoIP zero client tech is pretty seamless with the right backend & network configuration.
  - JoshTriplett 7y ago
    > Maybe I should keep a <$200 mini-PC, just to RDP into work so I have no problem giving up that machine. Doesn't help you. Either your personal devices are in scope or not. If they are, then they all disappear and you're unlikely to get them back. Investigators don't trust the subjects of the investigation to tell them what devices are in scope or not. If your devices are in scope, they'll take everything that has any chance of having data on it. (Source: many many reports from subjects of such investigations.)
    - kemiller2002 7y ago
      In the FBI's defense, they did return all the equipment after they were done with it (if I remember correctly within like a day too). Funny enough though, one guy thought it was strange that after they gave his phone back, all of his text messages from then on were suddenly emailed to his work email also. Wouldn't happen to be that all email in the company was saved indefinitely due to the archiving server?
bhandziuk 7y ago
Is this only true for using some company provided app or even a dedicated email app? What about just going to webmail on a browser on a phone? Does that have the same implication?
- colechristensen 7y ago
  This is true for any work interaction on your personal device. You aren't going to win arguing technicalities with someone executing a search warrant. The only safe and sane thing to do is refuse to have any work touch devices you own, and likewise don't let any of your personal affairs touch work systems.
mpeg 7y ago
And that's why you don't talk to police; they could have just said no or refused to answer to make it harder for the investigators.
- colechristensen 7y ago
  If the FBI comes in your office with a warrant and you refuse to speak I'm guessing they'll be taking your phone anyway and/or arresting you. Making things harder for investigators often means making things harder for yourself too. Winning an argument about your personal device's admissibility in court six months later isn't really winning is it?
  - sigstoat 7y ago
    the whole point of the above anecdote was that by answering the questions, you've expanded their scope. if they're going to arrest you, there's nothing you're going to say to talk them out of it. all you can do by talking is convince them to arrest you. you can't talk them out of anything they were already going to do; they're just talking to you because so many folks think the way you do, that they're somehow clever enough to say the thing that prevents the arrest. > Winning an argument about your personal device's admissibility in court six months later isn't really winning is it? it is if that means you don't go to jail. your advice is wildly dangerous, please stop.
  - saltminer 7y ago
    >you refuse to speak I'm guessing they'll be taking your phone anyway and/or arresting you If you refuse to speak without a lawyer there, they'll either a) move on because they're out fishing and you're not biting, or b) arrest you because they already have evidence but were looking for an easy confession to make it a slam dunk case for the prosecution. Once arrested, you can hire/be assigned a criminal defense attorney who will figure out if you have a good chance of being found innocent or can minimize prison time through a plea deal. >Winning an argument about your personal device's admissibility in court six months later isn't really winning is it? Not taking their bait and running your mouth will minimize the chances of the FBI being able to get a warrant for your device to begin with. It's not just about the phone, it's about your freedom, financial stability (you will lose your job and you can't pay your bills from prison, so say goodbye to your credit score), and employment opportunities (federal convictions don't bode well for job hunting). Look up "don't talk to the police" on YouTube if you want more reasons why letting the FBI look at your phone is a bad idea.
Railsify 7y ago
"...don't know who you are really working with..." this resonates with me, I recently left a company of finding out that the recently hired VP was the Presidents favorite bar tender, he was also trying to coax her into a relationship. The VP had also backdated her resume and was claiming to have been at the company about 4 years prior to her actual arrival.
- ChuckMcM 7y ago
  The back dating no doubt matched a back dated stock option grant that would allow her to claim that she was fully vested. That is just fraud and the board of directors should be all over it (they would have visibility into the hiring of executive staff). Now if the company has no board, or the board is composed entirely of founders, this sort of stuff slides by. Best to avoid working in the future with anyone associated with the senior staff in future companies.
  - Railsify 7y ago
    The company was owned by a single founder, the board was an advisory board with no real teeth, advisory board made up of good ole boys. The company folded early last year due directly to her management decisions, preceded by 3 other execs leaving, they all cited her decisions in their resignations. Sad because the product was coming along nicely, product market fit, positive feedback from customers, etc. I think the owner was just old and burnt out combined with a bit of "control all of a little rather than a little of a lot" syndrome.
    - ChuckMcM 7y ago
      Such a sad story. Not unique but sad none the less.
thisisit 7y ago
Recently my employer has pushed for Okta Identity management. And somewhere in that plan they somehow thought appropriating employee personal phones was a good idea. Now we can't login to certain internal apps without a mobile device because Okta needs one time password/accepting push notification. And the otp/push notification should necessarily happen on a mobile device. Given that company hasn't provided any mobile devices to employees, everyone is forced to use their personal phones. Any ideas on what happens in such cases?
- deleted 7y ago
  [deleted]
- benburleson 7y ago
  Respond that you have no mobile phone to use for this notification.
  - anticensor 7y ago
    Will not work here in Turkey.
    - type0 7y ago
      Why?
      - stallmanite 7y ago
        Maybe they don’t have great labor laws. Would your boss really believe you if you said you don’t have a cell phone? If you didn’t have legal protection (or a shit ton of other employment options) would you just tell him to fuck off?
        anticensor 7y ago
        No, we have great labour laws (employment protection, anti-discrimination, limits of business relationship well defined) but it is illegal to conceal identity in government and business matters (here in Turkey, you cannot avoid identifying yourself even while invoking the right against self-incrimination). Not like the UK or the US. Employer would think you try to conceal your essential contact info and will be able to refuse your contract. In addition, all IMSIs and IMEIs are registered in a whitelist and tied to identity.
joering2 7y ago
> After hearing about that, I never attach anything work related to my personal equipment. There is too much liability. Wait, didn't you just softly admit to some (any?) wrongdoing?
- ComputerGuru 7y ago
  Not even remotely. It’s good legal sensibility to avoid opening yourself up to unnecessary liability and investigation.
- kemiller2002 7y ago
  The simple truth is, everyone breaks the law. I don't mean willingly, there are tons of laws that exist that even well versed attorneys are not aware of. You accidentally downloaded a song you didn't pay for? We'll that's a criminal wrong doing. You did it over the internet? Somehow we'll tack on a wire fraud charge while we're at it, because we're sure we can convince a grand jury to at least allow us to try you. Now you're looking at a massive fine, and say 5-10 years. Sure you don't want to help us? By the way, if you've never been on the other end of an FBI agent interrogation, it's scary. Like really scary. I had a friend once show me briefly what it's like, and I never want to come near that again. Here's the thing about lawsuits, even if you're innocent, you're still probably ruined. It's not like on T.V., lawsuits take years, even criminal ones. If you encounter a law enforcement agent (say a prosecutor), that wants to make a career off of something you're involved in, you're screwed. At best, you'll probably be bankrupt and emotionally destroyed. Imagine this, they bring charges against you, and if you get a public intoxication, or heaven forbid a DUI, you go to jail for the next 3 years while awaiting trial and for something that you might not have even committed. Don't believe me, read a case document on conditions of release. They list off a ton of things that can send you back to jail while awaiting trial.
  - joering2 7y ago
    I don't know what country you reside, but in USA you are innocent until you are proven guilty. Prove of guilt is on the prosecution side, I don't have to prove I'm innocent. This and 5th amendment works magic against being wrongly accused; it also is indeed a deterrent to "carrier prosecutors" from trying to obtain prosecution via a good-old soviet style type of investigations: "give me a man, I give you a paragraph" Edit: don't break the laws when you being prosecuted; and BTW: I don't drink alcohol at all. Period.
jaclaz 7y ago
Hmmm, I don't think, if the allegations/accusations were "serious enough" that if (actually having never used the personal devices for work) someone had replied "No, never" they would have taken your word as good, i.e. they would have probably said "OK, now let's check if that is true" and confiscated the devices as well. Please also understand that when you say "No, never" to a FBI agent, you myst be pretty sure that it is accurate, as if they (still hypothetically) find even a single interaction they could accuse you to lying to a government officer. Anyway, yours is the right approach, never, and I mean never mix personal with work relatd activities.

eschneider 7y ago

Nothing focuses the mind on sensible email retention policies like working at a company where all the email got subpoenaed.

twic 7y ago
And since discovery processes are often leaky, pPart of the onboarding at my company is the lesson that you shouldn't write anything in an email that you wouldn't be happy to have splashed all over the Wall Street Journal. So, for example, we try to choose names for applications that aren't going to give people the wrong idea, eg don't call your market manipulation tool TurboMarketManipulator, call it EnhancedOrderManager.
- jrockway 7y ago
  > don't call your market manipulation tool TurboMarketManipulator, call it EnhancedOrderManager Good advice. I am somewhat surprised at times on what the media doesn't uncover and try to spin as a conspiracy theory. For example, we had this open source project publically available https://gfiber.googlesource.com/kernel/prism/ https://gfiber.googlesource.com/kernel/prism/ around at the same time as the Snowden leaks about "prism" and nobody wrote any articles about it. Of course, it's completely unrelated... but I feel that that normally doesn't stop people. I found the whole thing very interesting.
- me_again 7y ago
  "Dance like no one is watching; Email like it may one day be read aloud in a deposition" -- Olivia Nuzzi
- lbatx 7y ago
  I realize you are being somewhat facetious, but calling your (presumably unlawful) market manipulation tool EnhancedOrderManager isn't really the answer. Not building the unlawful tool is.

OrangeMango 7y ago

If you use your home computer to RDP into your work computer, what would be the correct answer to the question? The "work" occurs on the company-owned computer, but you are typing on the keyboard of your personally-owned computer.

ghostbrainalpha 7y ago
That's a good question. But as long as you don't save any files on your personal computer, it is just a transport device like a car that gets you to work. I'm guessing the law isn't that forward thinking though. Maybe I should keep a <$200 mini-PC, just to RDP into work so I have no problem giving up that machine.
- gumby 7y ago
  Clever. A modern day "dumb terminal"
  - oarsinsync 7y ago
    If you think that's clever, you'll be blown away when you see actual thin client and zero client hardware. PCoIP zero client tech is pretty seamless with the right backend & network configuration.
- JoshTriplett 7y ago
  > Maybe I should keep a <$200 mini-PC, just to RDP into work so I have no problem giving up that machine. Doesn't help you. Either your personal devices are in scope or not. If they are, then they all disappear and you're unlikely to get them back. Investigators don't trust the subjects of the investigation to tell them what devices are in scope or not. If your devices are in scope, they'll take everything that has any chance of having data on it. (Source: many many reports from subjects of such investigations.)
  - kemiller2002 7y ago
    In the FBI's defense, they did return all the equipment after they were done with it (if I remember correctly within like a day too). Funny enough though, one guy thought it was strange that after they gave his phone back, all of his text messages from then on were suddenly emailed to his work email also. Wouldn't happen to be that all email in the company was saved indefinitely due to the archiving server?

bhandziuk 7y ago

Is this only true for using some company provided app or even a dedicated email app? What about just going to webmail on a browser on a phone? Does that have the same implication?

colechristensen 7y ago
This is true for any work interaction on your personal device. You aren't going to win arguing technicalities with someone executing a search warrant. The only safe and sane thing to do is refuse to have any work touch devices you own, and likewise don't let any of your personal affairs touch work systems.

mpeg 7y ago

And that's why you don't talk to police; they could have just said no or refused to answer to make it harder for the investigators.

colechristensen 7y ago
If the FBI comes in your office with a warrant and you refuse to speak I'm guessing they'll be taking your phone anyway and/or arresting you. Making things harder for investigators often means making things harder for yourself too. Winning an argument about your personal device's admissibility in court six months later isn't really winning is it?
- sigstoat 7y ago
  the whole point of the above anecdote was that by answering the questions, you've expanded their scope. if they're going to arrest you, there's nothing you're going to say to talk them out of it. all you can do by talking is convince them to arrest you. you can't talk them out of anything they were already going to do; they're just talking to you because so many folks think the way you do, that they're somehow clever enough to say the thing that prevents the arrest. > Winning an argument about your personal device's admissibility in court six months later isn't really winning is it? it is if that means you don't go to jail. your advice is wildly dangerous, please stop.
- saltminer 7y ago
  >you refuse to speak I'm guessing they'll be taking your phone anyway and/or arresting you If you refuse to speak without a lawyer there, they'll either a) move on because they're out fishing and you're not biting, or b) arrest you because they already have evidence but were looking for an easy confession to make it a slam dunk case for the prosecution. Once arrested, you can hire/be assigned a criminal defense attorney who will figure out if you have a good chance of being found innocent or can minimize prison time through a plea deal. >Winning an argument about your personal device's admissibility in court six months later isn't really winning is it? Not taking their bait and running your mouth will minimize the chances of the FBI being able to get a warrant for your device to begin with. It's not just about the phone, it's about your freedom, financial stability (you will lose your job and you can't pay your bills from prison, so say goodbye to your credit score), and employment opportunities (federal convictions don't bode well for job hunting). Look up "don't talk to the police" on YouTube if you want more reasons why letting the FBI look at your phone is a bad idea.

Railsify 7y ago

"...don't know who you are really working with..." this resonates with me, I recently left a company of finding out that the recently hired VP was the Presidents favorite bar tender, he was also trying to coax her into a relationship. The VP had also backdated her resume and was claiming to have been at the company about 4 years prior to her actual arrival.

ChuckMcM 7y ago
The back dating no doubt matched a back dated stock option grant that would allow her to claim that she was fully vested. That is just fraud and the board of directors should be all over it (they would have visibility into the hiring of executive staff). Now if the company has no board, or the board is composed entirely of founders, this sort of stuff slides by. Best to avoid working in the future with anyone associated with the senior staff in future companies.
- Railsify 7y ago
  The company was owned by a single founder, the board was an advisory board with no real teeth, advisory board made up of good ole boys. The company folded early last year due directly to her management decisions, preceded by 3 other execs leaving, they all cited her decisions in their resignations. Sad because the product was coming along nicely, product market fit, positive feedback from customers, etc. I think the owner was just old and burnt out combined with a bit of "control all of a little rather than a little of a lot" syndrome.
  - ChuckMcM 7y ago
    Such a sad story. Not unique but sad none the less.

thisisit 7y ago

Recently my employer has pushed for Okta Identity management. And somewhere in that plan they somehow thought appropriating employee personal phones was a good idea. Now we can't login to certain internal apps without a mobile device because Okta needs one time password/accepting push notification. And the otp/push notification should necessarily happen on a mobile device. Given that company hasn't provided any mobile devices to employees, everyone is forced to use their personal phones. Any ideas on what happens in such cases?

deleted 7y ago
[deleted]
benburleson 7y ago
Respond that you have no mobile phone to use for this notification.
- anticensor 7y ago
  Will not work here in Turkey.
  - type0 7y ago
    Why?
    - stallmanite 7y ago
      Maybe they don’t have great labor laws. Would your boss really believe you if you said you don’t have a cell phone? If you didn’t have legal protection (or a shit ton of other employment options) would you just tell him to fuck off?
      - anticensor 7y ago
        No, we have great labour laws (employment protection, anti-discrimination, limits of business relationship well defined) but it is illegal to conceal identity in government and business matters (here in Turkey, you cannot avoid identifying yourself even while invoking the right against self-incrimination). Not like the UK or the US. Employer would think you try to conceal your essential contact info and will be able to refuse your contract. In addition, all IMSIs and IMEIs are registered in a whitelist and tied to identity.

joering2 7y ago

> After hearing about that, I never attach anything work related to my personal equipment. There is too much liability. Wait, didn't you just softly admit to some (any?) wrongdoing?

ComputerGuru 7y ago
Not even remotely. It’s good legal sensibility to avoid opening yourself up to unnecessary liability and investigation.
kemiller2002 7y ago
The simple truth is, everyone breaks the law. I don't mean willingly, there are tons of laws that exist that even well versed attorneys are not aware of. You accidentally downloaded a song you didn't pay for? We'll that's a criminal wrong doing. You did it over the internet? Somehow we'll tack on a wire fraud charge while we're at it, because we're sure we can convince a grand jury to at least allow us to try you. Now you're looking at a massive fine, and say 5-10 years. Sure you don't want to help us? By the way, if you've never been on the other end of an FBI agent interrogation, it's scary. Like really scary. I had a friend once show me briefly what it's like, and I never want to come near that again. Here's the thing about lawsuits, even if you're innocent, you're still probably ruined. It's not like on T.V., lawsuits take years, even criminal ones. If you encounter a law enforcement agent (say a prosecutor), that wants to make a career off of something you're involved in, you're screwed. At best, you'll probably be bankrupt and emotionally destroyed. Imagine this, they bring charges against you, and if you get a public intoxication, or heaven forbid a DUI, you go to jail for the next 3 years while awaiting trial and for something that you might not have even committed. Don't believe me, read a case document on conditions of release. They list off a ton of things that can send you back to jail while awaiting trial.
- joering2 7y ago
  I don't know what country you reside, but in USA you are innocent until you are proven guilty. Prove of guilt is on the prosecution side, I don't have to prove I'm innocent. This and 5th amendment works magic against being wrongly accused; it also is indeed a deterrent to "carrier prosecutors" from trying to obtain prosecution via a good-old soviet style type of investigations: "give me a man, I give you a paragraph" Edit: don't break the laws when you being prosecuted; and BTW: I don't drink alcohol at all. Period.

jaclaz 7y ago

Hmmm, I don't think, if the allegations/accusations were "serious enough" that if (actually having never used the personal devices for work) someone had replied "No, never" they would have taken your word as good, i.e. they would have probably said "OK, now let's check if that is true" and confiscated the devices as well. Please also understand that when you say "No, never" to a FBI agent, you myst be pretty sure that it is accurate, as if they (still hypothetically) find even a single interaction they could accuse you to lying to a government officer. Anyway, yours is the right approach, never, and I mean never mix personal with work relatd activities.