3 ms·

At my second job, the company terminated an employee for poor performance and intended to let them stay on a short term to wrap things up and then start their s

At my second job, the company terminated an employee for poor performance and intended to let them stay on a short term to wrap things up and then start their severance. The first evening (or maybe the first Friday evening), that dev stayed late in the office and deleted the source trees from as many machines as he could get access to (this was 1996, so most machines didn't have logins) and wiped the hard drive on the revision control server. That experience (and the amount of loss and wasted time in reconstructing as best we could) heavily colored my view of the risk-reward ratio of letting terminated employees have continued access to premises and systems. If I have any doubts about the future behavior of someone who just received very shocking, disorienting, and angering news, it is my job to protect the company and other employees much more than it is to allow the terminated employee continued access.

supriyo-biswas 3y ago
Also see the case of Shannon You[1] where the person in question leaked the trade secrets for BPA-free liner production used in soft drink cans for being fired. [1] https://www.justice.gov/usao-edtn/pr/phd-chemist-sentenced-168-months-conspiracy-steal-traded-secrets-economic-espionage https://www.justice.gov/usao-edtn/pr/phd-chemist-sentenced-1...
- anonexpat 3y ago
  You’s case was deliberate corporate espionage, not a disgruntled former employee.
madsbuch 3y ago
Given that this is the US, he was probably sued and is still in prison. Also, this is an insanely childish way to act – again to the original commenter. It it seems like there is a difference in US an EU culture here.
- dylan604 3y ago
  > Given that this is the US, he was probably sued and is still in prison. Like most things in life, it depends. You'd have to get a prosecutor to agree to accepting the case to bring charges against the individual. They'd have to decide if there was enough evidence, they'd have to decide if they thought they could convince a judge/jury, then they'd have to decide if it was even worth their time. In 1996, that might have been a more difficult thing to do than today. > Also, this is an insanely childish way to act Yeah? And? So? Are you attempting to say that no non-American has ever acted irrationally or childish? I have a few history books that would disagree
- michaelcampbell 3y ago
  > Also, this is an insanely childish way to act – again to the original commenter. It it seems like there is a difference in US an EU culture here. It is, but safety protocols are put in for the extreme unexpected case. "Regulations are written in blood" and all that. Not all Americans are childish any more than no EU citizens are.
  - yencabulator 3y ago
    [flagged]
Draiken 3y ago
So because the company hired a criminal sociopath, every other person laid off until the end of times must be treated the same way? Certainly there are better ways to handle even this crazy scenario you mentioned. That feels so inhumane to me. If you don't see your employees as humans, instead as mere resources and, as soon as they are laid off, threats, then we can say it makes sense.
- ianhawes 3y ago
  Similar things have happened in my ~12 year career which leads me to believe it is not as uncommon as your comment would portray it. The first instance I can recall, a developer was terminated and his access was revoked. He goes home, waits until midnight, then tries logging into as many systems as he can. He apparently had saved a WordPress password on his Google Drive. He logs into WordPress and defaces a bunch of pages on the corporate website. FWIW he was one of my reports and he did not come off as a sociopath or unstable and his actions surprised me. Second instance at a different startup, a marketing guy is terminated but was allowed to hang out at the office for a bit (for some reason management decided to fire him on a Thursday morning knowing he carpooled with several other employees). I felt bad so I took him out to lunch. At lunch he tells me he had a feeling he was about to be fired so he dumped the ~400K+ database of emails in our HubSpot account to sell to a competitor. I told him that was easily the dumbest idea he's ever had. I text the CEO from the bathroom to warn him. He's trespassed from the building upon our return. Oh, and he suspected I tipped them off and so he keyed my car. Third instance at my own company, I terminated a contractor and removed their access to all services immediately. They attempt to run a series of reports on vendors, contractors, and other sensitive data from the admin UI without realizing their session was invalidated. I get the error notifications and add more granular permissions to the admin panel. Is it inhumane? No. Is it rude? Yes. I think you have no choice _but_ to treat these people as humans. Humans do human things and act out for a variety of reasons and you have to expect that. Are they inherently bad people? No.
  - Draiken 3y ago
    I can definitely understand that assuming everyone is not a sociopath is very naive. But the reason I say this is inhumane is not about the security implications. There's a whole plethora of issues around layoffs that are often ignored. I recall looking at Slack's people list constantly to see which accounts were suddenly marked as "deactivated". People I had great relationships with but never exchanged personal emails simply gone. That dread of "what the fuck is happening" and "am I next?" overcoming you. Some people scramble to create sheets with contact information from those who were laid off. That's absolutely inhumane. I survived 3 layoffs in the past few years and I can still distinctly remember the awful feeling each of those left me with. I can only imagine how much worse that is for those affected. We can separate the security parts from the human parts. Companies choose not to do that, for whatever reason that I simply cannot understand. Especially companies with so called "human resources" should be extremely prepared for situations like this, to make sure everyone is actually treated well. Recently we had that viral video of a person that recorded themselves getting fired with zero reasoning of why. That's the kind of shit that happens with these layoffs. Bad management at its worst. In short, I agree with you with regards to security implications. But those can be solved with proper access controls and planning. What I don't agree with is everything else around it. Not once I have seen companies laying off people handle this in any manner that I would describe as humane. We can do better, I don't know why we don't.
rglullis 3y ago
Is that the lesson to learn here, really? An employee makes a stupid thing and the leadership didn't look into its security practices to avoid this type of attack?
- ianhawes 3y ago
  The lesson here is that once an employee or contractor is terminated, you remove all access to internal infrastructure. That's it. That is the lesson.
  - rglullis 3y ago
    Then your company is still susceptible to being destroyed by any random employee.
    - dylan604 3y ago
      Potentially, yes. Someone could go nutty before being dismissed, and it just be Tuesday. That's why there's things we often refer to in this industry as backups. If it is just a software bit of mischief, you should be able to recover from that without too much down time. s/disgruntled employee/ransom ware/ and it's really no different.
  - makeitdouble 3y ago
    Not "terminating" your employees and having meaningful conversations on how it goes after they know they're let go helps a lot. That forces the employer to come up with actual explainations someone can digest, and gives the employee time to be rational and plan the pivot. There will still be ugly stories, and preemptively removing accesses will be needed in some cases, but that's by far the exception and not the norm, and we usually know when that will be the case.
- osmano807 3y ago
  The lesson to learn is to entrench fail-deadly protocols in as much infrastructure as possible in case of termination.
smugglerFlynn 3y ago
If your crazy ex steals your watch on the way out, does it mean all new people you meet will get a frisk search at the end of each date? That’s not how trust works, regardless of potential consequences.
- sokoloff 3y ago
  No, but you probably do get your key back immediately after your next breakup.

supriyo-biswas 3y ago

Also see the case of Shannon You[1] where the person in question leaked the trade secrets for BPA-free liner production used in soft drink cans for being fired. [1] https://www.justice.gov/usao-edtn/pr/phd-chemist-sentenced-168-months-conspiracy-steal-traded-secrets-economic-espionage https://www.justice.gov/usao-edtn/pr/phd-chemist-sentenced-1...

anonexpat 3y ago
You’s case was deliberate corporate espionage, not a disgruntled former employee.

madsbuch 3y ago

Given that this is the US, he was probably sued and is still in prison. Also, this is an insanely childish way to act – again to the original commenter. It it seems like there is a difference in US an EU culture here.

dylan604 3y ago
> Given that this is the US, he was probably sued and is still in prison. Like most things in life, it depends. You'd have to get a prosecutor to agree to accepting the case to bring charges against the individual. They'd have to decide if there was enough evidence, they'd have to decide if they thought they could convince a judge/jury, then they'd have to decide if it was even worth their time. In 1996, that might have been a more difficult thing to do than today. > Also, this is an insanely childish way to act Yeah? And? So? Are you attempting to say that no non-American has ever acted irrationally or childish? I have a few history books that would disagree
michaelcampbell 3y ago
> Also, this is an insanely childish way to act – again to the original commenter. It it seems like there is a difference in US an EU culture here. It is, but safety protocols are put in for the extreme unexpected case. "Regulations are written in blood" and all that. Not all Americans are childish any more than no EU citizens are.
- yencabulator 3y ago
  [flagged]

Draiken 3y ago

So because the company hired a criminal sociopath, every other person laid off until the end of times must be treated the same way? Certainly there are better ways to handle even this crazy scenario you mentioned. That feels so inhumane to me. If you don't see your employees as humans, instead as mere resources and, as soon as they are laid off, threats, then we can say it makes sense.

ianhawes 3y ago
Similar things have happened in my ~12 year career which leads me to believe it is not as uncommon as your comment would portray it. The first instance I can recall, a developer was terminated and his access was revoked. He goes home, waits until midnight, then tries logging into as many systems as he can. He apparently had saved a WordPress password on his Google Drive. He logs into WordPress and defaces a bunch of pages on the corporate website. FWIW he was one of my reports and he did not come off as a sociopath or unstable and his actions surprised me. Second instance at a different startup, a marketing guy is terminated but was allowed to hang out at the office for a bit (for some reason management decided to fire him on a Thursday morning knowing he carpooled with several other employees). I felt bad so I took him out to lunch. At lunch he tells me he had a feeling he was about to be fired so he dumped the ~400K+ database of emails in our HubSpot account to sell to a competitor. I told him that was easily the dumbest idea he's ever had. I text the CEO from the bathroom to warn him. He's trespassed from the building upon our return. Oh, and he suspected I tipped them off and so he keyed my car. Third instance at my own company, I terminated a contractor and removed their access to all services immediately. They attempt to run a series of reports on vendors, contractors, and other sensitive data from the admin UI without realizing their session was invalidated. I get the error notifications and add more granular permissions to the admin panel. Is it inhumane? No. Is it rude? Yes. I think you have no choice _but_ to treat these people as humans. Humans do human things and act out for a variety of reasons and you have to expect that. Are they inherently bad people? No.
- Draiken 3y ago
  I can definitely understand that assuming everyone is not a sociopath is very naive. But the reason I say this is inhumane is not about the security implications. There's a whole plethora of issues around layoffs that are often ignored. I recall looking at Slack's people list constantly to see which accounts were suddenly marked as "deactivated". People I had great relationships with but never exchanged personal emails simply gone. That dread of "what the fuck is happening" and "am I next?" overcoming you. Some people scramble to create sheets with contact information from those who were laid off. That's absolutely inhumane. I survived 3 layoffs in the past few years and I can still distinctly remember the awful feeling each of those left me with. I can only imagine how much worse that is for those affected. We can separate the security parts from the human parts. Companies choose not to do that, for whatever reason that I simply cannot understand. Especially companies with so called "human resources" should be extremely prepared for situations like this, to make sure everyone is actually treated well. Recently we had that viral video of a person that recorded themselves getting fired with zero reasoning of why. That's the kind of shit that happens with these layoffs. Bad management at its worst. In short, I agree with you with regards to security implications. But those can be solved with proper access controls and planning. What I don't agree with is everything else around it. Not once I have seen companies laying off people handle this in any manner that I would describe as humane. We can do better, I don't know why we don't.

rglullis 3y ago

Is that the lesson to learn here, really? An employee makes a stupid thing and the leadership didn't look into its security practices to avoid this type of attack?

ianhawes 3y ago
The lesson here is that once an employee or contractor is terminated, you remove all access to internal infrastructure. That's it. That is the lesson.
- rglullis 3y ago
  Then your company is still susceptible to being destroyed by any random employee.
  - dylan604 3y ago
    Potentially, yes. Someone could go nutty before being dismissed, and it just be Tuesday. That's why there's things we often refer to in this industry as backups. If it is just a software bit of mischief, you should be able to recover from that without too much down time. s/disgruntled employee/ransom ware/ and it's really no different.
- makeitdouble 3y ago
  Not "terminating" your employees and having meaningful conversations on how it goes after they know they're let go helps a lot. That forces the employer to come up with actual explainations someone can digest, and gives the employee time to be rational and plan the pivot. There will still be ugly stories, and preemptively removing accesses will be needed in some cases, but that's by far the exception and not the norm, and we usually know when that will be the case.
osmano807 3y ago
The lesson to learn is to entrench fail-deadly protocols in as much infrastructure as possible in case of termination.

smugglerFlynn 3y ago

If your crazy ex steals your watch on the way out, does it mean all new people you meet will get a frisk search at the end of each date? That’s not how trust works, regardless of potential consequences.

sokoloff 3y ago
No, but you probably do get your key back immediately after your next breakup.