16 ms·
In Germany I was asked to provide my criminal record while working at a payment processing startup that had to obtain certain certificates. They were probably l
by dj_mc_merlin 6y ago
In Germany I was asked to provide my criminal record while working at a payment processing startup that had to obtain certain certificates. They were probably looking for crimes of a fiscal nature however, which is understandable. Second chances are second chances but security is mostly about trust.
Another job at a startup in Germany that worked in less tightly controlled spaces has never asked me to produce my criminal record, nor could they legally. An employer can only ask questions that are reasonably necessary for them to make a fair consideration about me as an applicant. You could ask an accountant about embezzlement convictions, a pharmacist about drug convictions etc., but that is not applicable to software engineers.
This is the only sane way to do things.
- nexuist 6y agoWhat crimes are applicable to software engineers, then? I don't think there are any laws punishing you from writing bad code, nor are there laws addressing data theft or security misconfigurations. GDPR applies against companies and not individual people, as far as I can tell. Would the only valid crimes be related to computer hacking?
- jedimastert 6y agoI could assume hacking, fraud, corporate espionage, etc. along with info relevant to the software (i.e. if you make banking software I'd assume fiscal crime would be at least somewhat relevant)
- monksy 6y agoHacking would probably be a plus for a software enginer. They know how to debug systems. Espionage, theft, and violent crimes... That's a different situation (I don't want someone coming after me after I liter their PR with comments)
- deleted 6y ago[deleted]
- gjs278 6y agook and they might hack a customer. or you after the fact if you upset them. it’s the violation of where they’re allowed to debug that is the issue.
- samatman 6y agoSure, and embezzlement might be a plus for a very specific finance job, namely, searching for evidence that embezzlement has happened. Point is that it's relevant under those circumstances, and fair play for an employer search. Drunken and disorderly is not.
- nikitaga 6y ago> Hacking would probably be a plus for a software enginer. They know how to debug systems. They also apparently have poor judgement and/or security practices, if they got themselves convicted under CFAA or similar. And possibly questionable moral integrity depending on what and how they were hacking. Background checks are not intended to evaluate skills but to find risks. Having a hacking conviction is generally not a positive signal.
- hirundo 6y agoI know a guy who spent a year in federal prison on bogus wire fraud charges for an article published in a hacker magazine. He was afraid it would cripple his career, but the opposite was true. He's now the chief technologist at a major CDN and his prison time translated into a badass semi-legendary hacker image.
- virgilp 6y agoWhereas if they're convicted for hacking, they'll only go after your digital assets/devices, so... no worries? After all, hacking convictions are a plus.
- kube-system 6y agoA charge of 'hacking' is like a charge of 'breaking and entering'. They could have cracked a bank vault mission-impossible style, or maybe they threw a brick through the window. For all you know, they could have 'hacked in' via the password on the post-it on their coworkers monitor.
- bluGill 6y agoIf you write software for banks, than all the crimes a banker could commit are easy for your to hide in code. If you write software for pharmacies then you can probably figure out how to to get any prescription you want to abuse into the system.
- voxic11 6y agoPerjury maybe? A lot of compliance relies on truthful reporting by employees.
- nix23 6y ago>Would the only valid crimes be related to computer hacking? Or willingly install Windows Server facing the internet directly, that would be the other one ;)
- bob1029 6y ago"Directly facing the internet" is a legitimate Windows Server configuration scenario for some use cases.
- moooo99 6y ago> Would the only valid crimes be related to computer hacking? Not necessarily. When working for a fintech or a bank, financial crimes can be very relevant. Writing bad code is, lucky me, not directly punishable as a crime.
- jacobwilliamroy 6y agoIn the United States "Unauthorized use of a computer" is a felony.
- BurningFrog 6y agoI would think any crime inflicting bodily harm is relevant, as long as you work near people with bodies.
- romwell 6y agoWhat you said implies that any person that has committed a violent crime remains a danger to other people, forever - and should also be punished, forever. This is what the American justice system is like. In a saner world, (only) people who are a danger to others would be separated from the society, and being set free would be and indication that you are no longer a danger. In the US, being released from prison signals you are more dangerous than if you got away with your crime.
- nicoburns 6y agoIt may be that it's not a criteria for not hiring them, but never-the-less something you want to keep an eye one once you do. And perhaps something you want to ask them about at interview.
- hevelvarik 6y agoI dunno, it takes a lot more than a fistfight to get put in prison for violent offense. Sure people can change but only a solid work history or trusted recommendation can give you any real confidence. You may have to fire this person, or they may have to report to an abusive manage for some period of time. Some offenses are difficult to walk away from untainted.
- Teever 6y agoThe summer after I graduated from HS a kid I knew got into a fist fight in the parking lot of a bar. He was punched once and he went down and cracked his skull on the curb and died. The person who hit him was charged with manslaughter.
- hevelvarik 6y ago
- cabaalis 6y agoI don't know of specific cases where a programmer was prosecuted, but I believe that knowingly and negligently leaving holes in compliance-heavy health technology (HIPAA) could result in prosecution.
- ScottBurson 6y agoWriting an entire operating system in an inherently insecure language?
- bee_rider 6y agoThis seems to be a pretty popular crime.
- poulsbohemian 6y ago>What crimes are applicable to software engineers, then? Ever see office Space? ;-)
- ainiriand 6y agoScrollbar hijacking should be 20 years to life.
- rorykoehler 6y agoTheft, fraud and violence are applicable for all jobs surely.
- LeifCarrotson 6y agoSurely not, if by "applicable" you mean to suggest that employers would never want to hire such a person for any job. Should a person convicted of theft, who's served their time, paid the fine, made the victims whole, and learned not to steal, be discarded from consideration as a useful member of society? In case it's not clear, I think they should have the same rights as any other human being. No one seriously advocates the death penalty or life imprisonment for petty crimes. But depending on the ability of a society to forget (which the information age is rapidly making very difficult) and the ability of a society to forgive (which the climate of fear is also making difficult), a conviction in your record can ruin a life.
- deathgrips 6y ago>and learned not to steal That's the issue at hand. Serving a prison sentence doesn't mean that you have learned not to steal. It's difficult for the company to verify that you have "learned your lesson".
- dj_mc_merlin 6y agoWhat will satisfy you then? Should people who come out from prison for stealing sit around jobless since nobody trusts them? That's bound to get them back into prison.
- waterhouse 6y agoHow about: an insurance policy such that, if the employee does end up stealing, then the employer is made whole. The former-thief employee could pay for such a policy, and then it would seem the employer would be indifferent between the former thief and the average applicant. The policy could be paid for out of the thief's salary; he would effectively be accepting a lower wage. If the job is minimum wage, of course, then it's not possible to lower the wage further. Also, discovering the theft and proving it was that employee might be difficult.
- tomjen3 6y agoHard disagree on that. As a programmer we have access to more than most accountants. How hard would it be for most programmers to put in a backdoor they could later claim was a bug? Criminal convictions are perhaps not the best measure of trustability.
- Dayshine 6y ago> As a programmer we have access to more than most accountants Do we? What does the average programmer working on internal business applications, b2b services or CMSs have access to that is of any risk?
- filleokus 6y agoIt's always hard to estimate what the average case is for something like this. But I would guess that the average programmer do have access to "production data". What that contain is obviously industry specific, and the most sensitive industries are (hopefully) well regulated and not average, like health care or finance. But I would guess that programmers at Tinder/Grindr/$datingSite had access to production data in the early days. Probably many SaaS things, perhaps doing stuff in the HR/recruitment/time reporting area. For B2B I'm guessing many programmers have access to business sensitive data, that competitors would like to get their hands on. At the least I would guess that at least the average backend developer have access to all contact info / emails for all users in services they work on. Obviously all best practices say that random Joe programmer shouldn't have access to these things, but I don't think that match the _average_ reality.
- exclusiv 6y agoI think so. Many sites have some sort of sensitive user data that could be exploited. If you work in ecommerce, you likely have access to the payment gateway as well.
- larrywright 6y agoThis is why all non-trivial applications need to have a code review process and a CI/CD pipeline that ensures that no application goes into production except via that pipeline, and that all code is reviewed prior to deployment. It’s not a guarantee, of course, but it’s a start.