Hacker News Reader

Comment by TehShrike | Hacker News Reader

He says

> None of the data I shared is from my organization and it was obtained entirely independently. I did not break any NDA or contract. I would never violate the trust of the organization I work for.

https://twitter.com/BillDemirkapi/status/1508614036719648771

View on HN

Doesn’t matter that it was obtained “independently”.

Doesn’t matter that he didn’t sign an NDA with Okta. Zoom certainly had agreements with Okta that prohibit employees from either company from sharing private information publicly like this. To remain compliant, they can’t continue to employ someone who is publicly violating that (with his handle emblazoned all over the documents, no less)

You can’t expect to work for a company while publicly leaking materials from one of their partners, regardless of how you acquired it.

Not that I disagree with your overall point, but how does that work for mega-huge companies? Microsoft/Visa/Google/etc likely have deals with everyone. If you work for a large company, you could essentially never disclose anything, regardless of the source.

Here's a rule of thumb that will work for you, no matter how large a company you work for or how you got the material or what agreements they have in place: if it's not explicitly public material you should not disclose it.

> if it's not explicitly public material you should not disclose it.

By definition anything you can get to independently is public material, as you are the public.

Public Material is the material the Company chose to make Public.

Many legal terms are different from their definition in OED.

That means if something is published in the NYT but the company didn't explicitly ask NYT to publish it, you have to treat it as private. This makes zero sense. And I want to see somebody try to win a legal case based on the theory that something published in NYT is not "public" because they didn't "choose" to make it public.

You've shifted the context to argue a nonsense point.

If NYT published info, and that's how you became aware of it, yes, it's Public.

But that was not the context I was replying to. My reply is in the context an individual employee making private information public.

A journalist informing GenPop of data is very different than an employee leaking.

Talk to your contracts or securities council for the details - scope and context are important.

Many government contractors couldn’t legally read the Snowden papers despite them being published in newspapers because they weren’t declassified.

Classified info has different rules. The government never plays by the same rules as mere plebes.

Can you please argue this in a court of law? I will gladly supply the popcorn.

Sure, but the parent comment said “explicitly public” which means information that satisfies both these criteria:

- you can get to it as the public

- the owner of the information considers it to be public (this is the “explicitly” part)

That's wrong. The crucial part is that it should apply to any random person, not just you. E.g. if it's published in a newspaper, or broadcast on a news channel, which anybody could watch, then it's public. If somebody told you, and only you, it's not public, because any random person couldn't get the same information.

The general policy at such companies is "don't disclose anything except what's on the website or in press releases without going through official channels"

If you're gonna post that sort of stuff you're going to have to do it anonymously. There are all kinds of NDA stuff about 3rd parties, customers, partner companies in every NDA I've ever seen. That's just life and a lot of the time life does not care about your morals or beliefs or opinions.

> the materials are from a Zoom partner company that provides a critical integration for the company’s operations? > Zoom certainly had agreements with Okta that prohibit employees...

Partner? Can you say more about this? How do you know Zoom and Okta are partners?

https://www.okta.com/partners/zoom/

That's a moot point. When in a non-disclosure agreement with a company, the binding part is that one will not divulge information about the company or potential partners. If one doesn't know if the company is a partner or not, they still can't divulge the information. If you've ever worked for one of these on-demand consulting firms, they go over this in detail. Basically, if a company tells me something on the call, and that includes information about another company, I can't tell a third party about it, nor can I mention it to the other company.

It is very likely Zoom and Okta are partners. Companies are constantly "partnering" with each other and all that means is there likely some agreement somewhere between them to not divulge information.

I think it's pretty clear the poster figured out they were in legal jeopardy, or were worried about it, given the content is now gone.

> If one doesn't know if the company is a partner or not, they still can't divulge the information.

So if Okta partners with 90% of tech companies, then no one can research what they do and talk about it?

And more generally who isn't a "potential partner"? Can we say anything about any company at all?

You should at least consider pseudo-anonymity

> When in a non-disclosure agreement with a company, the binding part is that one will not divulge information about the company or potential partners.

I don't think that's true for all NDAs.

> That's a moot point. When in a non-disclosure agreement with a company, ....

Do you know this because you're a lawyer?

This page on Okta's site links to their "Zoom Partnership Overview": https://www.okta.com/integrations/zoom/#overview

There are tens if not hundreds of thousands of organizations that log into Zoom via Okta.

When implementing SAML, the IdP and any given SP don't need to be partners or even know anything about each other. That's kind of the point.

It doesn't have to be obtained from your organization if it is an embarrassment to the company or its partners. It would be like an NSA Employee tweeting about Snowden.

Reply on news.ycombinator.com