5 ms·

There doesn't have to be a "network". This probably reached the highest executive levels and a few of them discussed it and said let's accidentally delete this

There doesn't have to be a "network". This probably reached the highest executive levels and a few of them discussed it and said let's accidentally delete this and take the fine. You're incredibly naive if you think this wasn't intentional.

andsoitis 3y ago
> highest executive levels and a few of them discussed it and said let's accidentally delete this So you think a few C-level execs went to 8,700 mail boxes and deleted 47 million messages to remove the EXACT evidence that was being subpoenaed?
- jokowueu 3y ago
  Here Is something You Should add to your Vocabulary https://en.m.wikipedia.org/wiki/Plausible_deniability https://en.m.wikipedia.org/wiki/Plausible_deniability
- wongarsu 3y ago
  Presumably they would have gone to some low-level tech and told him something to the effect of "We are looking for a new team lead, you might be a good fit. Completely unrelated: how difficult would it be for emails from the last couple years to be 'accidentally' deleted as part of routine operations". I'm not saying that's what happened, I find the sequence of events described by JP Morgan believable. But the same process issues that allowed this to happen accidentally would allow it to happen maliciously.
  - jerf 3y ago
    Your mental model is broken in that you seem to think the techs have independent models of what is and is not legal and will "legal fact check" the executives. In specific cases this may occur, but in general, if legal comes to a tech and says "we need to delete this", the tech will delete this. If you want to mess the tech around, you don't fire a guy and promote someone else and hire a private investigator to get blackmail on the database operator and hire the mafia to rough up the guy holding the backup tapes to make sure they get the message. You just tell the tech staff that legal says this has to happen. The tech staff does all sorts of things because legal tells them to, totally routine thing. This would not have stood out at all. I mean, I live this personally. When legal tells me to delete or retain something, I don't go get a law degree, and then insist that they let me have all the details to come to my own independent opinion about whether or not we need to delete or retain something. That is every bit as nonfunctional as when I tell them that the task they're asking for will take three weeks and they go get a programming degree and then come over and learn the exact environment we are working in so they can verify that we are telling them the correct estimate.
  - JumpCrisscross 3y ago
    > they would have gone to some low-level tech and told him something to the effect of "We are looking for a new team lead Part of the SEC’s process is peppering these people with pamphlets explaining how their testifying this happened is a $10+ million whistleblower payday.
  - Supermancho 3y ago
    > Presumably they would have gone to some low-level tech and told him something to the effect of "We are looking for a new team lead, you might be a good fit. Not a chance. NOTHING gets done at JPMorgan without a mountain-load of direction and a grip of meetings. This would have had to wipe out both the data and records of that direction. Because the layers of tape are so thick you can't travel floor to floor without an access card coding and used to log your time and that even these simple systems don't work all the time (which generates even more busy work, yay), it's a form of friction against any sort of "secret" dealings within the company. If your keycard/dev env/database access/wiki edits/etc are so chaotically managed, it's unlikely that you will leave 0 evidence behind. Note that there was enough information to reconstruct what happened, to some degree. I would bet someone didn't communicate the arcane symbol column that meant "do not delete for legal reasons", in some SQL. It's that chaotic, which reinforces the paranoia about the legal consequences that are foisted on every employee, routinely. If you have a shoplifting conviction (a record that hasn't been purged), you aren't getting hired. Viewed from the inside, it's strangely dystopian, but far from subtle.
    - lozenge 3y ago
      "JPMorgan hit with $200 million in fines for letting employees use WhatsApp to evade regulators' reach between 2018 and 2020" How did the bureaucracy let this happen if it's as big and bureaucratic as you claim? And there's other examples too.
      - deleted 3y ago
        [deleted]
      - Supermancho 3y ago
        Some executives going on WhatsApp to collude is going to be possible to this day, as long as the highest ranked member(s) ok it and there's no paper trail. It's not much different from after-work drinks, but they left records and got caught. shrug That's a different kind of corruption than what I was addressing, which does not involve technical operation. Not to brag, but I skirted company policies at JPMC. I had been tasked with writing a solution for a specific process that integrated a freeform type of data. I didn't use customer data or even sensitive company information, but did cobble something together that worked as a prototype over 6 months, in addition to my application workload. Due to some unannounced hardware refresh, my laptop was to be wiped. I decided to mail a zipfile of the custom javascript code (all open source or hand-written), to myself. There was a proper application (OneDrive) to normally store this kind of data, but it wasn't on my machine...which was probably part of the reason some laptops were being nuked. So, against, company policy I "mishandled source code" and got a 2-week-long wrist-slap over it. Was this "letting employees use email to evade company policies", or is it simply something that happens because there's no practical way to prevent me from doing it and still maintain standard business operation? It's important to read between the lines sometimes. Anything that requires participation of lower level employees, is different because they have to have explicit instructions and action plans to do anything...according to multiple policies and processes. If someone walked in and said "this is the SQL to use to delete this data for this JIRA ticket", it would be written down in a Confluence, JIRA, email, git, for starters. You would also have to have to account for the rollback as well, or it doesn't play.
- jon-wood 3y ago
  I just don’t buy it. Even a C-level has limits, whatever was being investigated currently just has the possibility of some big fines and maybe losing their job. As soon as they start colluding to destroy evidence that turns into jail time.
crhulls 3y ago
I run a very small public company, and can say from first hand experience it would be extremely difficult to do something like this let alone do it and not get caught. All emails and code changes are up for discovery and I don’t work with individual contributors directly so I’m not even sure how I would be able to give an instruction like this without many people wondering what was up. In the early days sure, I could go ask X person to access things directly but after a couple hundred people it doesn’t work that way. Think about an org of hundreds of thousands with the most strict compliance rules in existence. And doing something willful here would be jail time so why would someone already wealthy risk this? Even in a corrupt system people balance risk reward. A fine for the bank, fine, but life ruined forever stretches credulity given the limited upside.

andsoitis 3y ago

> highest executive levels and a few of them discussed it and said let's accidentally delete this So you think a few C-level execs went to 8,700 mail boxes and deleted 47 million messages to remove the EXACT evidence that was being subpoenaed?

jokowueu 3y ago
Here Is something You Should add to your Vocabulary https://en.m.wikipedia.org/wiki/Plausible_deniability https://en.m.wikipedia.org/wiki/Plausible_deniability
wongarsu 3y ago
Presumably they would have gone to some low-level tech and told him something to the effect of "We are looking for a new team lead, you might be a good fit. Completely unrelated: how difficult would it be for emails from the last couple years to be 'accidentally' deleted as part of routine operations". I'm not saying that's what happened, I find the sequence of events described by JP Morgan believable. But the same process issues that allowed this to happen accidentally would allow it to happen maliciously.
- jerf 3y ago
  Your mental model is broken in that you seem to think the techs have independent models of what is and is not legal and will "legal fact check" the executives. In specific cases this may occur, but in general, if legal comes to a tech and says "we need to delete this", the tech will delete this. If you want to mess the tech around, you don't fire a guy and promote someone else and hire a private investigator to get blackmail on the database operator and hire the mafia to rough up the guy holding the backup tapes to make sure they get the message. You just tell the tech staff that legal says this has to happen. The tech staff does all sorts of things because legal tells them to, totally routine thing. This would not have stood out at all. I mean, I live this personally. When legal tells me to delete or retain something, I don't go get a law degree, and then insist that they let me have all the details to come to my own independent opinion about whether or not we need to delete or retain something. That is every bit as nonfunctional as when I tell them that the task they're asking for will take three weeks and they go get a programming degree and then come over and learn the exact environment we are working in so they can verify that we are telling them the correct estimate.
- JumpCrisscross 3y ago
  > they would have gone to some low-level tech and told him something to the effect of "We are looking for a new team lead Part of the SEC’s process is peppering these people with pamphlets explaining how their testifying this happened is a $10+ million whistleblower payday.
- Supermancho 3y ago
  > Presumably they would have gone to some low-level tech and told him something to the effect of "We are looking for a new team lead, you might be a good fit. Not a chance. NOTHING gets done at JPMorgan without a mountain-load of direction and a grip of meetings. This would have had to wipe out both the data and records of that direction. Because the layers of tape are so thick you can't travel floor to floor without an access card coding and used to log your time and that even these simple systems don't work all the time (which generates even more busy work, yay), it's a form of friction against any sort of "secret" dealings within the company. If your keycard/dev env/database access/wiki edits/etc are so chaotically managed, it's unlikely that you will leave 0 evidence behind. Note that there was enough information to reconstruct what happened, to some degree. I would bet someone didn't communicate the arcane symbol column that meant "do not delete for legal reasons", in some SQL. It's that chaotic, which reinforces the paranoia about the legal consequences that are foisted on every employee, routinely. If you have a shoplifting conviction (a record that hasn't been purged), you aren't getting hired. Viewed from the inside, it's strangely dystopian, but far from subtle.
  - lozenge 3y ago
    "JPMorgan hit with $200 million in fines for letting employees use WhatsApp to evade regulators' reach between 2018 and 2020" How did the bureaucracy let this happen if it's as big and bureaucratic as you claim? And there's other examples too.
    - deleted 3y ago
      [deleted]
    - Supermancho 3y ago
      Some executives going on WhatsApp to collude is going to be possible to this day, as long as the highest ranked member(s) ok it and there's no paper trail. It's not much different from after-work drinks, but they left records and got caught. shrug That's a different kind of corruption than what I was addressing, which does not involve technical operation. Not to brag, but I skirted company policies at JPMC. I had been tasked with writing a solution for a specific process that integrated a freeform type of data. I didn't use customer data or even sensitive company information, but did cobble something together that worked as a prototype over 6 months, in addition to my application workload. Due to some unannounced hardware refresh, my laptop was to be wiped. I decided to mail a zipfile of the custom javascript code (all open source or hand-written), to myself. There was a proper application (OneDrive) to normally store this kind of data, but it wasn't on my machine...which was probably part of the reason some laptops were being nuked. So, against, company policy I "mishandled source code" and got a 2-week-long wrist-slap over it. Was this "letting employees use email to evade company policies", or is it simply something that happens because there's no practical way to prevent me from doing it and still maintain standard business operation? It's important to read between the lines sometimes. Anything that requires participation of lower level employees, is different because they have to have explicit instructions and action plans to do anything...according to multiple policies and processes. If someone walked in and said "this is the SQL to use to delete this data for this JIRA ticket", it would be written down in a Confluence, JIRA, email, git, for starters. You would also have to have to account for the rollback as well, or it doesn't play.
jon-wood 3y ago
I just don’t buy it. Even a C-level has limits, whatever was being investigated currently just has the possibility of some big fines and maybe losing their job. As soon as they start colluding to destroy evidence that turns into jail time.

crhulls 3y ago

I run a very small public company, and can say from first hand experience it would be extremely difficult to do something like this let alone do it and not get caught. All emails and code changes are up for discovery and I don’t work with individual contributors directly so I’m not even sure how I would be able to give an instruction like this without many people wondering what was up. In the early days sure, I could go ask X person to access things directly but after a couple hundred people it doesn’t work that way. Think about an org of hundreds of thousands with the most strict compliance rules in existence. And doing something willful here would be jail time so why would someone already wealthy risk this? Even in a corrupt system people balance risk reward. A fine for the bank, fine, but life ruined forever stretches credulity given the limited upside.