4 ms·

Out of interest, were you arrested? As part of a duress protocol — where your extortioner is likely observing you — law enforcement would be required to go thr

Out of interest, were you arrested? As part of a duress protocol — where your extortioner is likely observing you — law enforcement would be required to go through the motions of arresting you and taking you offsite. You can expect to be held for X hours regardless of whether they believed you had simply made a mistake. Long and unavoidable administrative delays make it much harder for villains to subvert protocols. See also time-delay bank vaults and mandatory two-week vacations for pension fund managers, where they are locked out of corpnet.

oasisbob 5y ago
No arrests. False alarms on silent alarm systems are common. Other factors made it clear that a real threat was unlikely. All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems.
- matrixagent 5y ago
  > All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems. Could you give some examples?
  - JulianMorrison 5y ago
    IIRC, over here, banks are required to give employees at least one two-week contiguous block of leave, during which they can't get into the office, use work systems, or log in remotely. The idea being that oh-so-clever scams generally require the operator to be there keeping all the balls in the air, and locking them out will reveal their tricks.
  - solatic 5y ago
    Mostly cases where businesses rely on individuals instead of process. As a simple example, it's very easy, when starting a company, to issue personalized email addresses to early employees and then people communicate using those email addresses. It's perfectly fine to email the CTO at first-name@example.com, because everyone knows everyone else and it works. As you grow large, it becomes important for people to address roles rather than individuals. This way, if people leave their role, they can (semi-transparently) be replaced by someone else taking that role who will then continue to receive all of the same emails, be able to respond to them, etc. So then it becomes important to have e.g. a cto@example.com address. When the CTO takes a vacation, their email gets routed to someone taking over their duties, you don't need to communicate to everyone to start emailing somebody-else@example.com instead.
    - stevenwliao 5y ago
      This isn't how any of my workplaces have worked. When someone leaves, they or their boss sends an email announcing the role changes. Which companies practice the role@ method?
    - matrixagent 5y ago
      Thanks, that's a great example. I've actually encountered this exact thing at my current employer as well.
  - 35fbe7d3d5b9 5y ago
    As JulianMorrison notes, this is common in finance. The FDIC strongly recommends that banks enforce this[1] – you can't cook the books when you have no access to the systems. But sometimes it's not just about cooking the books: the last "SSL cert expiration" fire I lived through happened because the person who had credentials to Digicert had to take sick leave. It was never a documented/defined process because "just flip Tim an email" was always sufficient, Tim didn't mind doing the work, and Tim didn't like going on vacation. Two week lockouts mean there's no chance of shadow IT/back channel work happening, and forces you to document your processes. [1]: https://www.fdic.gov/news/financial-institution-letters/1995/fil9552.html https://www.fdic.gov/news/financial-institution-letters/1995...
    - matrixagent 5y ago
      Thank you, that’s another good example, to which I wish I could relate less. ;)
- oofoe 5y ago
  My old company locked us out several years ago for a period of time that continues to be uninterrupted. It certainly did shake out lots of problems... (My point is that after having had that happen to me, if it EVER happens again and isn't cleared up within minutes, the sonic boom you hear will be my tactical resume deployment. I dismissed the warning signs as "minor glitches". Never again. However, if it is something planned and I agreed to it beforehand, I guess that's OK. On second reading, you might have been describing something like that.)
pyuser583 5y ago
Is it legal for them to arrest you simply to keep up the appearance? You haven’t done anything illegal.
- inglor 5y ago
  Not from the US, but here at a bank I worked with: If you trigger the silent alarm they'd have reason to suspect you are threatened and would take you to custody to make sure you are safe and release you once it's sorted out (probably an hour or so).
  - pyuser583 5y ago
    That makes sense. Sorting things out takes time. But trying to create an illusion that no alarm was triggered to prevent criminals from gaining knowledge: not a reason to imprison an innocent person.
    - nextlevelwizard 5y ago
      >imprison an innocent person. Kind a hard word to use for an arrest. In many places police can arrest you for some period if they suspect you have committed a crime. This is no different. No need for sensational language.
      - pyuser583 5y ago
        In the US they can’t do anything unless they have “probable cause” you committed a crime. That’s broad, but it excludes “this guy pushed the number 6 three times in a row.” And “imprison” and “arrest” are pretty darn close. In the US, when you are arrested, you are usually searched, fingerprinted, and a mugshot is taken. The mugshot can become a public record. There are websites that match mugshots to names, and make money by being paid to take mugshots down. Nobody wants the google result for their name to be a mugshot.
        nextlevelwizard 5y ago

oasisbob 5y ago

No arrests. False alarms on silent alarm systems are common. Other factors made it clear that a real threat was unlikely. All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems.

matrixagent 5y ago
> All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems. Could you give some examples?
- JulianMorrison 5y ago
  IIRC, over here, banks are required to give employees at least one two-week contiguous block of leave, during which they can't get into the office, use work systems, or log in remotely. The idea being that oh-so-clever scams generally require the operator to be there keeping all the balls in the air, and locking them out will reveal their tricks.
- solatic 5y ago
  Mostly cases where businesses rely on individuals instead of process. As a simple example, it's very easy, when starting a company, to issue personalized email addresses to early employees and then people communicate using those email addresses. It's perfectly fine to email the CTO at first-name@example.com, because everyone knows everyone else and it works. As you grow large, it becomes important for people to address roles rather than individuals. This way, if people leave their role, they can (semi-transparently) be replaced by someone else taking that role who will then continue to receive all of the same emails, be able to respond to them, etc. So then it becomes important to have e.g. a cto@example.com address. When the CTO takes a vacation, their email gets routed to someone taking over their duties, you don't need to communicate to everyone to start emailing somebody-else@example.com instead.
  - stevenwliao 5y ago
    This isn't how any of my workplaces have worked. When someone leaves, they or their boss sends an email announcing the role changes. Which companies practice the role@ method?
  - matrixagent 5y ago
    Thanks, that's a great example. I've actually encountered this exact thing at my current employer as well.
- 35fbe7d3d5b9 5y ago
  As JulianMorrison notes, this is common in finance. The FDIC strongly recommends that banks enforce this[1] – you can't cook the books when you have no access to the systems. But sometimes it's not just about cooking the books: the last "SSL cert expiration" fire I lived through happened because the person who had credentials to Digicert had to take sick leave. It was never a documented/defined process because "just flip Tim an email" was always sufficient, Tim didn't mind doing the work, and Tim didn't like going on vacation. Two week lockouts mean there's no chance of shadow IT/back channel work happening, and forces you to document your processes. [1]: https://www.fdic.gov/news/financial-institution-letters/1995/fil9552.html https://www.fdic.gov/news/financial-institution-letters/1995...
  - matrixagent 5y ago
    Thank you, that’s another good example, to which I wish I could relate less. ;)
oofoe 5y ago
My old company locked us out several years ago for a period of time that continues to be uninterrupted. It certainly did shake out lots of problems... (My point is that after having had that happen to me, if it EVER happens again and isn't cleared up within minutes, the sonic boom you hear will be my tactical resume deployment. I dismissed the warning signs as "minor glitches". Never again. However, if it is something planned and I agreed to it beforehand, I guess that's OK. On second reading, you might have been describing something like that.)

pyuser583 5y ago

Is it legal for them to arrest you simply to keep up the appearance? You haven’t done anything illegal.

inglor 5y ago
Not from the US, but here at a bank I worked with: If you trigger the silent alarm they'd have reason to suspect you are threatened and would take you to custody to make sure you are safe and release you once it's sorted out (probably an hour or so).
- pyuser583 5y ago
  That makes sense. Sorting things out takes time. But trying to create an illusion that no alarm was triggered to prevent criminals from gaining knowledge: not a reason to imprison an innocent person.
  - nextlevelwizard 5y ago
    >imprison an innocent person. Kind a hard word to use for an arrest. In many places police can arrest you for some period if they suspect you have committed a crime. This is no different. No need for sensational language.
    - pyuser583 5y ago
      In the US they can’t do anything unless they have “probable cause” you committed a crime. That’s broad, but it excludes “this guy pushed the number 6 three times in a row.” And “imprison” and “arrest” are pretty darn close. In the US, when you are arrested, you are usually searched, fingerprinted, and a mugshot is taken. The mugshot can become a public record. There are websites that match mugshots to names, and make money by being paid to take mugshots down. Nobody wants the google result for their name to be a mugshot.
      - nextlevelwizard 5y ago