Forgot your password?
typodupeerror
The Courts IT Your Rights Online

How IT Pros Can Avoid Legal Trouble 230

Posted by Soulskill
from the don't-listen-to-michael-bolton dept.
snydeq writes "InfoWorld's Peter S. Vogel reports on the kinds of inadvertent transgressions that could land IT pros into legal trouble without realizing it. From confidentiality and privacy negligence, to copyright and source code violations, IT staff are legally liable for a lot more than they might think — in some cases because the law will not stop at your employer, instead holding individual IT employees responsible for violations even if the individuals are just 'doing their job.' Worse, as the recent case against Terry Childs has shown, judges and juries are often not technically savvy enough to understand what IT pros do. 'That lack of understanding can lead them to conclude you're at fault or should have known better,' Vogel writes. 'After all, many people think anyone technical is a whiz kid or brainiac on any topic.'" What legally questionable scenarios have cropped up at your job?
This discussion has been archived. No new comments can be posted.

How IT Pros Can Avoid Legal Trouble

Comments Filter:
  • Liability (Score:5, Funny)

    by nhaines (622289) <.moc.utnubu. .ta. .seniahn.> on Monday July 19, 2010 @04:46PM (#32956022) Homepage

    I'm liable for first posts.

  • by Anonymous Coward on Monday July 19, 2010 @04:46PM (#32956034)

    He was a petulant child.

    This narrative that this ruling could affect non-sociopaths is FUD.

    • by Toonol (1057698) on Monday July 19, 2010 @05:05PM (#32956350)
      Terry Childs is a terrible poster child for IT professionals. He did all sorts of things professionally and ethically wrong, and probably legally wrong, as well. I certainly would have pressed charges if he had been my employee.

      However, there are some legal traps that even a well-behaved IT pro can fall into. For instance, monitoring too much can be a privacy invasion, monitoring not enough can be negligence. Because the IT word scales up so much, sometimes a minor mistake can end up with millions of dollars of consequences.
      • Re: (Score:3, Interesting)

        by b4upoo (166390)

        Perhaps I am now misinformed but as I understand it liability for content never exists unless some censorship takes place on a network. Therefore it would seem to me that the very last thing one would ever want to do is look at any form of content flowing through a network.
        But I can not see failure to hand over a password being a crime. It may well have wreaked havoc with a system but that was not Terry's problem nor if he was dismissed did he have a

  • Licensing (Score:5, Informative)

    by CaptSlaq (1491233) on Monday July 19, 2010 @04:48PM (#32956050)
    It's such a gigantic PITA to track all of the licensing for everything that I weep for any small to medium sized shop that can't afford to have a dedicated person/dedicated people for it.
    • Re: (Score:2, Insightful)

      by h4rr4r (612664)

      The solution to that is to not buy such software.
      If it is not free or simply licensed, just do not use it.

      • Re:Licensing (Score:5, Insightful)

        by toastar (573882) on Monday July 19, 2010 @05:11PM (#32956436)

        The solution to that is to not buy such software.
        If it is not free or simply licensed, just do not use it.

        ... tell that to my boss.

        • Re: (Score:2, Insightful)

          by h4rr4r (612664)

          That is your job. You are his technical resource.

          • Re:Licensing (Score:5, Insightful)

            by Brandee07 (964634) on Monday July 19, 2010 @05:39PM (#32956780)

            Your job is to keep his copy of Microsoft Office working, not to tell him that he should switch to OpenOffice.

            In my limited workplace experience, if you answer "Fix my software" with "Use this other software instead," you will either be ignored or fired. (I found myself ignored, but instilled with a profound desire to not attempt to be helpful again.)

            • Re: (Score:3, Interesting)

              by h4rr4r (612664)

              No, my job has no MS software involved. Helpdesk can go handle that.

              We as a company have moved all non-managers over to openoffice. Money talks.

            • Re: (Score:2, Insightful)

              by Anonymous Coward

              Your job is to keep his copy of Microsoft Office working, not to tell him that he should switch to OpenOffice.

              In my limited workplace experience, if you answer "Fix my software" with "Use this other software instead," you will either be ignored or fired. (I found myself ignored, but instilled with a profound desire to not attempt to be helpful again.)

              Depends on how your phrase the question. Say "Switch to OpenOffice" then you've already failed. Talk about reducing company wide 10-year Licensing Fees by 100% and you have them hooked. IT has no place for ideals sadly, so I just sell them at their game.

            • "In my limited workplace experience, if you answer "Fix my software" with "Use this other software instead," you will either be ignored or fired."

              As you should be. The solution to "I need to open this document so I can display it at a meeting in 10 minutes. I tested it yesterday but it's not working now." is not "go install other software and get that working, then try to unbreak all of the ms-specific formatting that OO.org can't handle".

              Sure, as the IT guy it's your job to suggest that the company make
          • You are his technical resource.

            Jeez, nothing dehumanizing about that title.

            • by Surt (22457)

              But the further you get from 'Emergency snack', the further you get from an honest assessment of reality, so given how much nerds like to keep things real, you have to find a balance.

      • Re: (Score:3, Insightful)

        The solution to that is to not buy such software.

        If it is not free or simply licensed, just do not use it.

        If your word processing and checking your e-mail, fine. But some of us have real jobs. Jobs that require using the same tools as your customers, or simply access to specific applications.

        • Re: (Score:3, Informative)

          Or network monitoring, or running a call center, or running any kind of website, e-commerce business, or accounting, etc..

          The only places where I personally have seen open-source be woefully lacking is in the engineering fields. Most general business and IT-oriented tasks have a capable open-source commercially backed component. Managers and others who don't "get" FOSS think "Free? I'm not getting anything, because I'm not blindly throwing money at a vendor!"

    • Re:Licensing (Score:5, Interesting)

      by Dr Herbert West (1357769) on Monday July 19, 2010 @05:08PM (#32956404)
      I can't tell you how many shops I've worked at where it was obvious that all the software was cracked. My favorite was a print vendor who would encourage his staff (college interns) to "bring in" some of their school software/plugins to "test in a real-world environment". Anytime someone had to send a job to print, all the workstations would have to be disconnected from the network or else there would be licensing conflicts with all the cracked warez. This was more than a decade ago, and the vendor in question has been out of business for a long time. Scumbag-- everything he did somehow reeked of illegality.

      I remember I came in once (this was right after I started) only to find the entire staff (except the interns) had quit without warning. Everyone from the production managers to the secretaries-- gone. I soon followed, natch!
      • I worked at a place where they had N licenses for $EXPENSIVE_PROCESSING_SOFTWARE. This software was business-critical. In order to meet processing demand, this software was installed on at least 3N machines... including all our desktops.

        Plus most of the computers were running "legitimate" ("it's just a backup copy of our volume license disc", he promised) copies of Win2k and MS Office. At least the data servers were running Linux...

        I did my best to avoid license violations while I worked there. I used m

        • Re: (Score:3, Informative)

          by bickerdyke (670000)

          Don't use N... that sounds too much like a countable, natural number.

          It's usually more like: We have N employees, each of them has at least one workstation, plus 0 to M old/test machines under his desk. Half of those secondary machines have been reinstalled once or twice, again half of those re-installs included an OS upgrade. Those were done using the OEM licences included with the new primary machines, as on those primary machines software licencsed by the companys volume licence has been used.

          Now triple

      • Re:Licensing (Score:5, Interesting)

        by 24-bit Voxel (672674) on Monday July 19, 2010 @06:33PM (#32957536) Journal

        I've seldom worked at a place that didn't pirate software. From fortune 500 to mom and pop shop, they all do it. The annoying part is I actually purchase mine, and in 3D that's not cheap. Ive spent easily 30K in the past 3 years keeping 'legal' with my software only to be underbid by these pirate shops. Now I am contracting at one because I can't win a bid against these pirates as their overhead is much lower than mine because of this.

        My favorite part is negotiating my rate for a contract and I stipulate that it's cheaper if I can work from home because I have full support of my fully paid for software. They almost never get it at first, but when I mention my one caveat of not supporting or bug fixing/debugging scenes made with pirated versions. That wakes them up every time. Mostly because the first two weeks are at a preset lower rate while we get used to eachother. Only after those two weeks I am privy to all sorts of info (such as pirating) and then they are often afraid not to hire me in case I rat them out. It's a shitty system with a couple perks.

    • Re: (Score:3, Informative)

      by ultranova (717540)

      The solution is simple: use only GPL- or BSD-licensed stuff. Problem solved.

      Using proprietary software at all is asking for trouble.

      • ...or a software licenced per concurrent user,controlled by a dedicated server.

        • Re: (Score:3, Interesting)

          by darkpixel2k (623900)

          ...or a software licenced per concurrent user,controlled by a dedicated server.

          Yeah--but then you run into the shitty software that does something like "INSERT INTO CurrentSessions WorkstationName VALUES ('BILLS-PC')"...and when the application crashes, there's no delete. So you have to call the vendor to get a special 'unlock' password to clear that crap out of the database (if you're the kind of person that doesn't know SQL)... It's so much easier when software companies don't treat their users like criminals--because the criminals don't care, and the users are the ones jumping t

    • Re:Licensing (Score:5, Interesting)

      by jimicus (737525) on Monday July 19, 2010 @06:20PM (#32957348)

      I agree, but I'd go further - and my comments apply equally to free and commercial software.

      We're a small shop and part of my job is to keep on top of licensing. After doing this job for some years, I have reached an inevitable conclusion.

      You are not supposed to get it 100% right. Indeed, you are being set up for failure .

      While some licenses are fairly straightforward, enough of them are sufficiently complicated that it is wholly unrealistic to expect any organisation to be entirely perfect. Whether this is by accident or design I wouldn't like to say, but I am dead certain that there is no organisation on God's sweet earth that would come out of a BSA audit without at least something wrong.

  • by Michael Kristopeit (1751814) on Monday July 19, 2010 @04:49PM (#32956064)
    not post in this thread.
  • by bsDaemon (87307) on Monday July 19, 2010 @04:49PM (#32956066)

    Are the same people claiming that Childs is some sort of mis-understood hero the same people who had "Free Kevin" schwag back in the day? If not, I'm not sure I get the mentality, because from what I know of the situation (maybe not enough), he did sort of grossly overstep the bounds. Maybe he didn't deserve jail time, but I'm not about to go emulating my career after him.

    • Re: (Score:3, Insightful)

      by FooAtWFU (699187)
      Whether Childs was ultimately right or wrong, I think the case *did* highlight concerns that "judges and juries are often not technically savvy enough to understand what IT pros do." So. There you go.
      • by Anonymous Coward on Monday July 19, 2010 @05:07PM (#32956394)

        Umm no. I disagree entirely. Are we forgetting there was a network engineer on the jury? Seriously? This is exactly the sort of thing that SHOULD happen. A jury of his "peers!"

        It was described to the engineer, and he was the de-facto explainer for the group, but seriously Childs was working for the gov't too long and had too many bad habits of "fiefdom" creation that are everywhere in city and state organizations. He created a world, then he took the keys away from everyone and didn't give it up. He's not the first, nor will he be the last, but the lesson here should be to all comers "hit by bus strategy... always." Otherwise, things that together could be suspect or could be best practice BECOME suspect without a backup and recovery plan.

        And no, an encrypted that's tattoo'd to an admin's ass doesn't count. Especially if there's a likelyhood of a flame thrower being involved at some point.

        • by Joe The Dragon (967727) on Monday July 19, 2010 @05:15PM (#32956502)

          Do to cut backs he was the only guy on the job 24/7 and lot of the people there did not have a clue at all. And giving the out the network pass word over a open phone call in a big meting room?

        • by XanC (644172) on Monday July 19, 2010 @05:21PM (#32956568)

          That network engineer, IIRC, said here something to the effect that he didn't think Childs had any criminal intent, and that he was doing what he thought was right for the city. The only reason for the conviction was that the letter of the law appeared to be against him.

          This was a case where a fully informed jury should have acquitted, but unfortunately juries are not fully informed. A jury has the right, nay the responsibility, to judge the LAW as well as the FACTS.

          Basically, put yourself in Childs' situation. You did what you thought was right. (Let's assume that's the case, since I believe that's what the juror said.) Wouldn't you hope that somebody would inject some common sense at some point rather than robotically reading the law?

          That's why we have juries. But judges tell them all they can do is robotically read the law. It's awful.

          http://fija.org/ [fija.org]

          • Re: (Score:3, Insightful)

            by spire3661 (1038968)
            Good intentions rarely excuses malfeasance and is usually non-exonerating. You can have the best of intentions and still be found guilty. The law does take intent into account, but it isnt a free pass.
            • Re: (Score:3, Insightful)

              by XanC (644172)

              It certainly can be, depending on the situation. Especially in cases where the law and the situation are both so convoluted, like this one, that the defendant had no reasonable way to know ahead of time that he was committing a crime.

              If it takes the jury more than a half hour to determine that a crime was even committed, and the defendant was in good faith attempting to fulfill all his obligations but struck a different, but still reasonable, balance from the one the jury would have picked, I don't see how

          • by david_thornley (598059) on Monday July 19, 2010 @05:54PM (#32956978)

            From what I gathered, Childs (a) broke the law, (b) didn't do the right thing (specifically, the city was in real trouble if he got hit by a bus), and (c) tried to run away, suggesting he thought he'd be in trouble.

            Lack of criminal intent and good intentions go only so far in mitigating breaches of the law, and my common-sense injection would have been that Childs had gone over the line and should be convicted. Had Childs provided for the possibility of his sudden demise, I'd feel a lot better towards him, and I'm not at all sure he'd have been convicted.

            • Both wrong. (Score:3, Informative)

              by Anonymous Coward

              Both wrong.

              (a): there was no law demanding he hand over the keys unsecurely
              (b): he did the right thing. If he'd been hit by a bus, they could reset the passwords by getting an engineer out to the sites.

              Terry did the RIGHT thing according to law and the thing demanded by his employment contract. That contract stated who he could give the passwords to, where and who could override those orders.

              A general cannot order a Private on Guard Duty (assigned as such by the Duty Officer) to leave his post. Doing so wou

              • Re: (Score:3, Informative)

                by jroysdon (201893)

                They could not just reset the password. The routers/switches were configured with "no service password-recovery" and could not just be reset. If they had been, it would have wiped out the configuration on all of the devices and all of the agencies depending on them would have been down.

                If the device configurations had been properly backed up and documented somewhere, this would not have been a problem (I don't know one way or another, but clearly no one in charge knew if they were or had enough of a clue)

              • Re: (Score:3, Interesting)

                (a) There was policy that he had to hand over the keys securely, which he refused to do earlier. That is one of the things that led to conviction.
                (b) If he'd had been hit by a bus, there was no way known at the time to reset passwords without destroying the configuration, which was not satisfactorily documented. (Think about this - you don't want people to be able to walk up to such a device and pwn it. Routers like those cannot necessarily be kept physically secure.)

                Nor, apparently, did his contract

      • Really? One of the members of the jury was an 'IT pro.' It may be true that often judges and juries are not technically savvy enough, but I don't think that case was a very good illustration of that point.
      • by bws111 (1216812) on Monday July 19, 2010 @05:14PM (#32956486)

        Why is it a "concern" that judges and juries don't understand what IT pros do? Judges are supposed to understand the law. Period. Juries are supposed to be unbiased. Period. Is it a "concern" that judges and juries don't understand what police detectives do? Doctors? Hospital ethics boards? Accident reconstruction experts? Corporate officers? Accountants? Fund managers? Etc, etc. If the judge or jury needs to understand any of those things it is up to the parties in the case to educate them. There is nothing special about IT that makes it any more or less difficult to explain than anything else.

        • Re: (Score:3, Interesting)

          by MightyMartian (840721)

          Childs was a petulant prima dona with delusions of grandeur, and he paid the price, and so it should be. I know some folks seem to want to make the guy some martyr, but he was a complete twit, and I wouldn't hire the guy to wipe out floppies, let alone manage a large network. Not because he isn't skilled, but because he's a self-important ass hat.

          • by Itninja (937614)

            Childs was a petulant prima dona with delusions of grandeur....he's a self-important ass hat.

            I don't think any of those things have 'price' to 'pay'. In fact, toss in ambition, and you have a nearly perfect description of the traits needed to be blindly successful (professionally anyway). I am pretty sure he 'paid the price' for being a scofflaw and (eventually) a convicted felon.

        • by tool462 (677306)

          Nonsense. The things I do are difficult, challenging, and require a vast intellect to understand. The things everybody else does are so simple and obvious a child could do them. /me removes tongue from cheek.

    • by _Sprocket_ (42527)

      Are the same people claiming that Childs is some sort of mis-understood hero the same people who had "Free Kevin" schwag back in the day? If not, I'm not sure I get the mentality, because from what I know of the situation (maybe not enough), he did sort of grossly overstep the bounds. Maybe he didn't deserve jail time, but I'm not about to go emulating my career after him.

      Mitnick's following wasn't because he was a swell guy. It was an issue of overzealous prosecution and inappropriate detainment (i.e. a belief he could launch nuclear missiles by whistling in to a prison pay phone). In the end, he was little more than a white-collar thief and con-man who was reported as being, and consequently treated as, a supervillian master-mind. Some people took offense to that.

      Childs is interesting in a lot of ways. He's been portrayed as a criminally-minded digital tyrant holding a

  • Change jobs.
    • by yincrash (854885)
      Of course, why didn't I think of that sooner?!
    • Even better, stop before the second step in that process of being re-hired. Potential liability problems... solved forever!

  • by Peach Rings (1782482) on Monday July 19, 2010 @04:51PM (#32956098) Homepage

    I'm a medical equipment technician at a California corrections facility. My boss routinely asks me to kill people in cold blood, and I've been doing it for a few years now... there's a lot of paperwork and everything, but I'm not entirely sure it's legal.

    Does anyone else have experience with being ordered to kill somebody as part of their IT duties?

    • Re: (Score:3, Funny)

      by DWMorse (1816016)
      You get to do what Batman cannot!
    • Does anyone else have experience with being ordered to kill somebody as part of their IT duties?

      I... well, it's complicated.

      My boss will routinely design intricate dream levels and then ask me to enter the dreams of a rival and extract corporate secrets. I haven't run in to any legal trouble yet but I do have to watch out for the dreamer's projections. They get very hostile if I take to long in the dream world.

      Does this help you? I'm sorry... I'm having a lot of trouble focusing right now...

      ...Have we met before, or was I dreaming??

    • Re: (Score:3, Interesting)

      by cosm (1072588)

      I'm a medical equipment technician at a California corrections facility. My boss routinely asks me to kill people in cold blood, and I've been doing it for a few years now... there's a lot of paperwork and everything, but I'm not entirely sure it's legal.

      I can't tell if your're trolling or serious. Are you responsible for the lethal injection equipment? Or are you Therac-25ing cons to oblivion during simple 'treatment' procedures? I guess the key piece of missing information is the 'medical equipment' in question.

    • by Surt (22457) on Monday July 19, 2010 @07:04PM (#32957874) Homepage Journal

      When I had to do that, I couldn't live with the moral qualms, so what I did, I hooked up the kill mechanism to a web server, and created this animated ad where if you punched the monkey it would kill the person.

  • by Monkeedude1212 (1560403) on Monday July 19, 2010 @04:51PM (#32956100) Journal

    When someone at work has a blackberry, they are set up on the Blackberry enterprise server, which manages all their contacts and emails and calendar and such.

    If they leave, or are terminated, we are told to send the kill command to their BES account. This will delete any emails off their phone AND their contact details. In some cases, a person will be let go - our IT staff will be let known first so their account can be disabled for security reasons. Then that recently laid off person has lost all of their contact details - including Mom and Dad and sweet Great Aunt Gertrude.

    We haven't faced any legal suits yet - but it happened a couple times where people have gotten angry. As a precaution - we've started informing people that this happens - so anyone with a blackberry needs to back up their contacts constantly.

    • by jobugeek (466084)
      If these are company blackberrys then you are probably screwing up by telling people to back up their contact information. Many times IT departments are informed first, so that kind of information can not be backed up, particularly in cases of sales personnel or anyone who could take those contacts/emails to a competitor
      • by ultranova (717540)

        If these are company blackberrys then you are probably screwing up by telling people to back up their contact information. Many times IT departments are informed first, so that kind of information can not be backed up, particularly in cases of sales personnel or anyone who could take those contacts/emails to a competitor

        And that actually works?

        Were I a salesperson, I would backup all my company issued gear daily, precisely to avoid this kind of problems. Do you perhaps think that actual salespersons are su

        • by Surt (22457)

          I guess I assume most salespeople are idiots because the base rate of psychopathy in the population isn't supposed to be all that high.

  • You're kidding... (Score:5, Insightful)

    by Un pobre guey (593801) on Monday July 19, 2010 @04:52PM (#32956110) Homepage
    What legally questionable scenarios have cropped up at your job?

    You have got to be shitting me. This isn't phishing, this needs a new term all its own.
  • Har Har (Score:4, Funny)

    by poliscipirate (1636723) on Monday July 19, 2010 @04:58PM (#32956208)

    'After all, many people think anyone technical is a whiz kid or brainiac on any topic.'

    Obviously, they've never visited slashdot.

  • The BSA does not go after the techs but they are a paper work b* and will hit for not having the paper work they want and some times it's not what you think you need to have.

  • We were in creditor protection (Canadian version of Chapter 11 Bankruptcy), and the owner asked me to essentially spy on the Court appointed monitors and send him any email they sent or received when they were on site and using our computer systems. Thankfully, I had the presence of mind to know how wrong that was, and went to the Accounting controller to inform him of that request. In the end the courts were not told of his transgressions as that would have caused him a pile of trouble (he most probably wo

  • by girlintraining (1395911) on Monday July 19, 2010 @05:01PM (#32956274)

    Here's one: I worked for one of the top national retail firms. Their POS systems were booted using PXE, and there was no firwalling between the stores and corporate HQ. In other words, the network topology was completely flat. Setup a PXE server at any store, distribution center, or headquarters, and you could respond to PXE requests sent by the POS systems. The store's location was coded into the DNS RR, and followed an easy to understand naming convention -- they also were powered down every evening. Which means, you had about a 10 minute window each day where if you disabled or DDoS'd the one PXE server on the network, you would be able to send a bootable image to every POS server in that timezone.

    They fired me three days after reporting this flaw, calling me a security risk.

    • by Frequency Domain (601421) on Monday July 19, 2010 @05:22PM (#32956586)
      At first I thought POS meant "Point of Sale", but as I read through your post I realized it actually stands for "Piece of..."
    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Here's one: I worked for one of the top national retail firms. Their POS systems were booted using PXE, and there was no firwalling between the stores and corporate HQ. In other words, the network topology was completely flat. Setup a PXE server at any store, distribution center, or headquarters, and you could respond to PXE requests sent by the POS systems. The store's location was coded into the DNS RR, and followed an easy to understand naming convention -- they also were powered down every evening. Which means, you had about a 10 minute window each day where if you disabled or DDoS'd the one PXE server on the network, you would be able to send a bootable image to every POS server in that timezone.

      They fired me three days after reporting this flaw, calling me a security risk.

      Maybe you shouldn't have informed them via a custom Windows splash screen...

    • by idiot900 (166952) * on Monday July 19, 2010 @05:38PM (#32956768)

      They fired me three days after reporting this flaw, calling me a security risk.

      What a brilliant idea by whoever fired you - producing a disgruntled former employee who knows how to steal money from the company.

    • Re: (Score:2, Insightful)

      by FelixNZ (1426093)
      Wow, that's incredible, unless you were a contractor, I am extremely glad to be in a country that has sane employment law right now.
    • by _Sprocket_ (42527)

      Whatever happened to TJ Max anyway?

  • by eldavojohn (898314) * <eldavojohn.gmail@com> on Monday July 19, 2010 @05:02PM (#32956282) Journal

    What legally questionable scenarios have cropped up at your job?

    I'm a software developer for one of the big automotive companies and we almost got into some legal trouble a while back. We had another team that would test the embedded code we put in there and we were always playing pranks on each other between the two teams. So one time, I wrote a procedure that cause the accelerator to randomly speed up with no user interaction. It was very very rare that the procedure would trigger and then I called it right in the middle of the main block of the embedded code. Anyway, they run a bunch of tests a day and on the like the fortieth day, John drove his car right through the wall of the testing facility! Oh my, what a hoot, I haven't laughed so hard since they air lifted him out. But then there was all this legal BS about somebody getting hurt and this and that. Those law-talking guys have no sense of humor. So I realized I had to go in and comment out that procedure. So all I did was go in and comment out the signature block ... or at least I think that took care of it, but maybe it was that fancy ECC crap the smart guy put in ... I wonder if anyone ever went back in there and totally cleaned it up? Oh well ... dodged a bullet there ... am I right?

  • by stephanruby (542433) on Monday July 19, 2010 @05:03PM (#32956308)

    Worse, as the recent case against Terry Childs has shown, judges and juries are often not technically savvy enough to understand what IT pros do. 'That lack of understanding can lead them to conclude you're at fault or should have known better,'

    Has it shown that really??? I recall the foreman of the jury for the Terry Childs case was a pretty smart IT guy. Also, the resumes of the other jurors were not all that bad technically either. If anything, I really do think that Terry Childs was judged by a jury of his peers (even if this doesn't always happen in other cases).

  • by linebackn (131821) on Monday July 19, 2010 @05:04PM (#32956326)
    Worse, as the recent case against Terry Childs has shown, judges and juries are often not technically savvy enough to understand what IT pros do

    As I recall, when the details finally came to light about what he did and how he went about it, the judge and jurry WERE technically savvy enough to understand what he did. It was all the people jumping to uninformed conclusions here on Slashdot that didn't understand.

    I have no doubt there are plenty of cases where judges and juries fail to understand the facts at hand, but I don't think this was one of them.
  • how about makeing EULA that non legal types can read and under stand not all work places have the means to take the time for legal to look at all of them.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      Most EULAs aren't actually that difficult to read. They're just long and boring...

    • by cjb658 (1235986)

      Because then some people might figure out what they're actually agreeing to and stop buying their software?

  • by Rene S. Hollan (1943) on Monday July 19, 2010 @05:06PM (#32956372)

    I have often been either asked to use pirate copies of software (Borland Turbo C in the 1980s), or accept license agreements personally, where a corporate license would have been more fitting. Neither of these have occurred at my present place of employment, thankfully.

    In other areas, I was once asked by a low-level manager at a client company of our contracting firm for my SSN for a "background check". I was told this person had a reputation of committing identity theft in the name of contractors, obtaining credit in their name, and threatening to insist they be removed from the assignment if they complained. I don't know if that was true, but did insist that any "background check" would be done by a recognized neutral party. I was requested removed from the assignment, and let go for lack of other work.

    On the pirate software issue, I simply licensed my own copies, and took them with me when I left (well, wiped them off my work computer). Borland's license would let me use their compiler on any machine, even let someone else use it, one at a time.

    The bottom line is that if your employer asks you to break the law, find another job... fast.

  • by Joe The Dragon (967727) on Monday July 19, 2010 @05:11PM (#32956442)

    How about legally liable for the PHB and other higher up people at the work place who don't know about IT but they buy stuff on the golf course buy they fail to buy the right licenses and they they tell the techs that proper license are done / the buying department took care of it.

    In some places the IT guy do not buy any thing they just tell some what they need and hope to get it.

  • by HikingStick (878216) <z01riemer@hotmail . c om> on Monday July 19, 2010 @05:39PM (#32956786)
    One problem I see is that requirements may not be the same from state to state (in the US), and there are few formal resources available for IT professionals to know exactly what requirements apply. This is especially true for IT pros in smaller, or privately held firms that don't fall under the authority of some of the big bills that have been enacted. None of the college programs in my area even has a course addressing these issues, except for specific courses dealing with things like HIPPA. This seems to be a big gap, and I know I'd love to find a course (or even a website) that deals with specific requirements both at the State and Federal levels.
  • I haven't run afoul of any laws, writing software, but I'm always tangling with copyright readers and software licenses whenever I start up a project (which happens every year or two). Open source licenses especially, since the standing rule is that 'copyleft is bad, because we want to keep control of our work'.

    Software licenses come up every couple months, but the shop does a good job keeping the site licenses for the software that we use, and personal software is discouraged. I have a couple sets of VS8

  • by Anonymous Coward

    asked for a reprint of the customer listing. A couple of days later the two vp's asked for the same thing. The company was shut down about 3 months later and I was the only one hired by the parent company.

    About two months later I was called in the attorney's office. I was asked if I distributed any unauthorized customer lists.

    Damn.

    • by pclminion (145572)
      Maybe I'm missing something... What would be bad about giving the president of the company a list of the company's customers? Huh?
  • I live in France so software patents, in theory, do not exist. But I have American and Japanese clients. What happens then ?

    I offer (freely) some web services like IRC or forums. If someone infringes a silly law from a silly country by saying something illegal in either the country I live in, the country where the server is located or the country where the user is, how are the responsibilities split ?

    Some of the code I develop at my work is open source (BSD). But BSD has no French translations and no
  • 'After all, many people think anyone technical is a whiz kid or brainiac on any topic.'
    Just because *I* am doesn't mean other IT people are.
    IANAL, IANAMD, IANAE, IANARS, IANAMCSE
  • by mjwalshe (1680392) on Monday July 19, 2010 @06:52PM (#32957748)
    A good recent example of how techs could get in trouble would be the techs that set up the spying on kids via webcam in Philadelphia. Congratulations you have just set up a child porn machine. I trust that all involved will never be able to work with kids and vunerable people again - and that would be getting off lightly, in the UK you would probaly have a tabloid lynch mob out for you.
  • by Opportunist (166417) on Monday July 19, 2010 @09:56PM (#32959408)

    Why?

    Because I'm in IT security. My job is to analyze and dissect malware, not only to find out what it does but also how it does it, what attack vectors are used, what system flaws are exploited, what means of communication with a controlling server are used and, if possible, I should also try to cut those lines and render the malware useless, preferably create some kind of remedy or even protection against it. All this can usually only be done by taking a closer look at the software than is possible by simply watching it run. In other words, disassembly and protocol sniffing and decoding are two of the main parts of my work. Both already illegal in some countries.

    Now, fortunately my country provides protection for this (albeit ... well, I have a law that I might pull out of my ass should I need it, but it's anything but a certain victory in case anyone ever goes to court for it). But in theory, any writer of malware could pull any IT security company to court and stand a pretty good chance to win. Though he'd first have to admit that it was him who created the malware.

    In other words, as odd as it may be, I may violate that copyright because the one who could drag me to court for it certainly has no interest to come forwards and claim ownership of the code.

    And now let's ponder for a moment what will change should ACTA become reality and copyright violations get shifted from civil to criminal code. Technically, the State Attorney would have to step forward and protect the copyright of the writers of malware without them asking for it (because the SA has to act even without prompting from the injured party) and prosecute those that analyze malware and design protection and remedies against it.

    You see, you don't have to be the bad guy to think that ACTA is a really, really bad idea...

I bet the human brain is a kludge. -- Marvin Minsky

Working...