Hacker News Reader

He says

> None of the data I shared is from my organization and it was obtained entirely independently. I did not break any NDA or contract. I would never violate the trust of the organization I work for.

https://twitter.com/BillDemirkapi/status/1508614036719648771

Doesn’t matter that it was obtained “independently”.

Doesn’t matter that he didn’t sign an NDA with Okta. Zoom certainly had agreements with Okta that prohibit employees from either company from sharing private information publicly like this. To remain compliant, they can’t continue to employ someone who is publicly violating that (with his handle emblazoned all over the documents, no less)

You can’t expect to work for a company while publicly leaking materials from one of their partners, regardless of how you acquired it.

Not that I disagree with your overall point, but how does that work for mega-huge companies? Microsoft/Visa/Google/etc likely have deals with everyone. If you work for a large company, you could essentially never disclose anything, regardless of the source.

Here's a rule of thumb that will work for you, no matter how large a company you work for or how you got the material or what agreements they have in place: if it's not explicitly public material you should not disclose it.

> if it's not explicitly public material you should not disclose it.

By definition anything you can get to independently is public material, as you are the public.

Public Material is the material the Company chose to make Public.

Many legal terms are different from their definition in OED.

That means if something is published in the NYT but the company didn't explicitly ask NYT to publish it, you have to treat it as private. This makes zero sense. And I want to see somebody try to win a legal case based on the theory that something published in NYT is not "public" because they didn't "choose" to make it public.

You've shifted the context to argue a nonsense point.

If NYT published info, and that's how you became aware of it, yes, it's Public.

But that was not the context I was replying to. My reply is in the context an individual employee making private information public.

A journalist informing GenPop of data is very different than an employee leaking.

Talk to your contracts or securities council for the details - scope and context are important.

Many government contractors couldn’t legally read the Snowden papers despite them being published in newspapers because they weren’t declassified.

Classified info has different rules. The government never plays by the same rules as mere plebes.

Can you please argue this in a court of law? I will gladly supply the popcorn.

Sure, but the parent comment said “explicitly public” which means information that satisfies both these criteria:

- you can get to it as the public

- the owner of the information considers it to be public (this is the “explicitly” part)

That's wrong. The crucial part is that it should apply to any random person, not just you. E.g. if it's published in a newspaper, or broadcast on a news channel, which anybody could watch, then it's public. If somebody told you, and only you, it's not public, because any random person couldn't get the same information.

The general policy at such companies is "don't disclose anything except what's on the website or in press releases without going through official channels"

If you're gonna post that sort of stuff you're going to have to do it anonymously. There are all kinds of NDA stuff about 3rd parties, customers, partner companies in every NDA I've ever seen. That's just life and a lot of the time life does not care about your morals or beliefs or opinions.

> the materials are from a Zoom partner company that provides a critical integration for the company’s operations? > Zoom certainly had agreements with Okta that prohibit employees...

Partner? Can you say more about this? How do you know Zoom and Okta are partners?

https://www.okta.com/partners/zoom/

That's a moot point. When in a non-disclosure agreement with a company, the binding part is that one will not divulge information about the company or potential partners. If one doesn't know if the company is a partner or not, they still can't divulge the information. If you've ever worked for one of these on-demand consulting firms, they go over this in detail. Basically, if a company tells me something on the call, and that includes information about another company, I can't tell a third party about it, nor can I mention it to the other company.

It is very likely Zoom and Okta are partners. Companies are constantly "partnering" with each other and all that means is there likely some agreement somewhere between them to not divulge information.

I think it's pretty clear the poster figured out they were in legal jeopardy, or were worried about it, given the content is now gone.

> If one doesn't know if the company is a partner or not, they still can't divulge the information.

So if Okta partners with 90% of tech companies, then no one can research what they do and talk about it?

And more generally who isn't a "potential partner"? Can we say anything about any company at all?

You should at least consider pseudo-anonymity

> When in a non-disclosure agreement with a company, the binding part is that one will not divulge information about the company or potential partners.

I don't think that's true for all NDAs.

> That's a moot point. When in a non-disclosure agreement with a company, ....

Do you know this because you're a lawyer?

This page on Okta's site links to their "Zoom Partnership Overview": https://www.okta.com/integrations/zoom/#overview

There are tens if not hundreds of thousands of organizations that log into Zoom via Okta.

When implementing SAML, the IdP and any given SP don't need to be partners or even know anything about each other. That's kind of the point.

It doesn't have to be obtained from your organization if it is an embarrassment to the company or its partners. It would be like an NSA Employee tweeting about Snowden.

The leak is already widely available publicly. It's OSINT now, public domain. Pretending like it doesn't exist is going to do customers a lot more harm than good, so doing your part to make sure that people know that these materials are public is 100% in the interest of the public, and Zoom's customers.

> The leak is already widely available publicly. It's OSINT now, public domain. Pretending like it doesn't exist is going to do customers a lot more harm than good, so doing your part to make sure that people know that these materials are public is 100% in the interest of the public, and Zoom's customers.

Yeah, but what an employee thinks is good for the customer is irrelevant. What the company thinks is good for the customer is the relevant question.

If the employee thinks that republishing publicly available leaks is good for the customer, they should get permission from the company before publishing it.

It's not the employee's call, even if it is in the customer's interest.

Whistle-blowing is a totally different thing; this wasn't that.

This is why anonymity is important. Having grew up in the 80's getting internet in the 90's, using "real names" online was unthinkable.

OTOH it's been curious to see the real humans I only knew by famous nicknames come out, in more recent times.

I have had many names over the years... I tend to shred them every 2 years or so, this one has lasted longer than normal, and I am close to shredding it just lazy..

I dont think I will ever change that, and keep a fake name very long, and I can never envision going full real names.

> I’m surprised they even offered to let him stay if he removed them

Isn’t it just like with the police, they can legally lie in this context? “If you turn yourself in we’ll go east on you”. They can just turn around and fire him anyway because it is an at will work state

> They can just turn around and fire him anyway

There wouldn't be much point in them lying like that. He can also just turn around and repost the tweets after all.

This is a warning or future leakers not an attempt to put the genie back in the bottle since that information is out forever.

Actually, for publicly sharing leaked private materials of partner companies, the offer to delete the tweets instead of getting fired was merciful.

I agree, Zoom seemed willing to work with the ex-employee.

Unfortunately people often overlook that they are an ambassador for the company they work for. Their employer will usually not tolerate aggravating a (potential) revenue-generating relationship with a third party by any employee.

I believe Zoom did the right thing here, but I’m curious what CA law says.

I believe that California is an 'at-will' state so it might not make any difference, but I'm not a lawyer.

I suspect the firing would happen either way, but the difference would be in how the company handled it. Delete the tweets and the person gets a severance, maybe a "layoff" instead of firing with cause, and no pushback on unemployment claims. Don't delete it, fired with cause, no severance, no unemployment, potential criminal charges.

It looks like the tweets are gone now anyway.

I think so, they don't need the bad publicity so let it die down and fire him in 3 to 6 months out for something else but really this.

that's the difference between countries where workers are protected and where they are not.

You can't fire someone just because they posted pictures online only because you don't like them, where I live.

Because your employer have no saying in what you do in your private life.

The most probable outcome if the picture were removed was being fired from Zoom after removing the pictures.

At least now we know about them.

These weren’t pictures of him wearing a racy outfit on a vacation.

He works in the tech industry, and he posted leaked documents from a tech company. His employer can pretty sanely draw the parallel and say “we don’t want to employ someone who is OK with broadcasting leaked documents from companies like ours”. Even in countries with different levels of worker protections, that’s a pretty clear cause for termination.

> He works in the tech industry, and he posted leaked documents from a tech company

You can't be fired for that.

It's against the law.

The leaker is responsible, not the employer posting them.

As it should be in a decent country with decent laws in the west.

We don't live in Vladimir Putin's Russia, do we?

> Even in countries with different levels of worker protections, that’s a pretty clear cause for termination.

actually, it is not.

And if you really wanna try that, you can't do it without a judge saying you could do it.

And if the employer is right, you have to give them the job back and pay all the legal fees.

>It's against the law.

I am pretty sure you are mistaken here; there is no law that protects him in this case. The whistleblower protection act only protects federal workers. Other than that California is an at-will state and leaking private information is not a protected class

> The whistleblower protection act only protects federal workers

Not talking about the US here, but, as I've said "countries where workers are protected by the law"

> > He works in the tech industry, and he posted leaked documents from a tech company

> You can't be fired for that.

> It's against the law.

Citation needed. In most US states you can be fired for no reason at all.

> Citation needed. In most US states you can be fired for no reason at all.

Here's the quote you're looking for

> that's the difference between countries where workers are protected and where they are not.

> You can't fire someone just because they posted pictures online only because you don't like them, *where I live.*

https://news.ycombinator.com/item?id=30843101

USA is specifically *not* one of those countries.

I’d love to know which country protects disclosing confidential data explicitly forbidden in your work contract because it’s on “personal time”.

Your work contract explicitly says "you can't disclose confidential data that's not related to your employment"? Fairly sure mine only talks about data related to my employment (i.e. company data, customer data, ... - anything I got access to through work).

So if some outsider leaked a confidential document from your employer and you posted it on Twitter you'd be fine because "it's not related to your work"?

I somehow doubt it.

> You can't fire someone just because they posted pictures online only because you don't like them, where I live.

I think you may be confusing authorities here? You can't be prosecuted for merely disseminating trade secrets. It's not illegal.

But your employer can fire you for it. They can fire you for almost any reason they want (exceptions, e.g. for reasons of ethnicity or some other protected class, tend to be spelled out explicitly in legislation). Freedom of association goes both ways. Zoom is under no obligation to continue to pay someone that is hurting the company.

Parent does say "where I live".

(which I am guessing is Europe and probably Spain, though as the username reads "People from Ibiza" it could be a German or a Brit ;-)

Close, but wrong.

Italy.

Same goes in France, Spain, Germany, Portugal etc etc

So your country doesn't have NDAs with corporations? Good luck attracting companies there. Also this isn't really against the law, it's against an agreement with his company where he signed up for things like being fired or potentially even sued. It's not like anyone is going to toss him in jail.

He didn't "leak" the materials, as far as I can see, only reproduced them.