BlueWolf's Howl

« PhysicaLogical Security | Bluewolf's Howl | Mobile Phone Banking? »

December 11, 2006

Hacker or Hero?

A former IT executive at publishing company SourceMedia has been arrested and charged with hacking into the company's network, reading confidential e-mails, and tipping off employees who were in line to be laid off.

Okay... I do know and agree that hacking into a network (unauthorized access) is illegal. But this story has a lot of other shards sticking into it.

As director of IT and later VP of technology, he reportedly had access to the passwords for the e-mail accounts of SourceMedia employees.

So - let's start with the boneheads who give their passwords out. Well, maybe these execs gave their password to a trusted employee in IT. But the guy was terminated in 2003! Did it take the FBI three years to trace this back? Or did it take 3 years to go to court? Maybe they're talking about him having access to everyone's password. But if this happened less than 3 years ago -- why weren't these users *forced* to change their passwords after a certain amount of time? Is this another case of "the important execs can't be bothered with remembering changing passwords, so they use the same one forever"??? If so, the former exec might not be the only one with unauthorized access to executive email.

The other issue is the intent and motivation for the hacking. I'm sure there was quite a bit of information in those mail accounts. He could have used 'inside' information for playing the stocks, selling trade secrets to their competitor, or sending bogus emails to create all kinds of havoc. But, out of all the information that he was privy to, he used the information about layoffs to warn his former subordinates. Not many would have been so selfless.

Which brings me to the point about layoffs... Employers are always demanding at least 2 weeks notice before you leave a company. I've yet to see a company hire a replacement before a month is out and any 'outbriefing' normally lasts a day or two (not a week or two). Yet, when they lay people off, it always remains a BIG SECRET until the moment they spring it on you. Granted, if you get fired for cause, you don't deserve notice - you've earned it in some way over time. But layoffs are different. Layoffs are supposedly a tough financial decision because the company can no longer support the position or payroll. It's supposed to have nothing to do with you personally and nothing to do with your performance. So why is it 'fair' to keep it a big secret? Don't you value these employees? Wouldn't you hope for the best for them - which through a layoff you're saying you can no longer provide?

And in the end, he really did the company a favor. If you lay off an employee, you normally give them severance pay and they qualify for unemployment - which is a financial hit on the company. If the employee finds another job and leaves, all that is a mute point and you've reduced your rolls without any of the burden. So why is it a big secret to begin with? Is it because the company believes it will lower morale? In reality, it's just the opposite. Being open and upfront strengthens morale. When you keep it hush-hush and the axe falls out of nowhere, the remaining employees never rest. You end up losing your best people - because they never know when it will happen to them. It will always come as a surprise like it did to the people who already got axed. If you're honest about pending layoffs, the rest of the workforce can be assured that they will know in advance and can work productively without worry.

Leaders always look out for their people - which is why their people would move mountains for them. If this guy ends up in charge at another company, I'm sure he will have a loyal following. But which company will trust him?

Posted by BlueWolf on December 11, 2006 08:19 AM