Hacker News Reader

Comment by gurchik | Hacker News Reader

> We legally need the work laptop back, but we’ll help pay for a new one to replace it.

What law? I’m not criticizing Spotify at all for this decision, I’m just genuinely curious. A few other companies recently are giving away the laptops so I’m wondering what is different here.

View on HN

They're likely speaking of their liability should a employee's laptop, containing sensitive information, ever be stolen or re-sold (or simply, left in the hands of an ex-employee with a grudge.)

It would be difficult for a IT department to guarantee, for sure without replacing the internals of the device, that the device doesn't contain sensitive information. Probably easier from an inventory and IT security perspective to just capture every device than try and coordinate with individuals to reformat, etc.

(for the same reason, some companies outright destroy old devices instead of reselling.)

I think it's actually a really easy guarantee on modern laptops from a technical standpoint, but that doesn't matter if there's a compliance requirement or contract they signed with major customers.

There are a lot of customer requirements around mobile device management and the like that arguably don't make a lot of difference for any employee wanting to work around them. But they're there so companies need to follow them.

I know that Macs can give that level of assurance. One click from the MDM can brick the machine out to the point where it cannot even be booted from external media without a code, and another trashes the encryption keys and does a factory reset.

That's bizarre or just shoddy IT. Every major platform has remote wipe and self destruct capabilities, control over full disk encryption, etc. I guess they let people bring their own devices and just not follow solid IT practices?

Well, to properly erase (multiple overwrites and erase) I suppose IT would need to get the computer back for a while so it can fully complete without the employee removing the IT tool which can handle this removal.

Secondly, would you want to have a computer which your previous employer can wipe your disk at any time?

So all in all probably a good thing for both parties.

If it's full disk encrypted then wiping and rewiping doesn't matter as much. As soon as the keys are trashed the data might as well be all zeros. Remote wipe is the whole point, it's not a goodbye gift to the employee... it's protecting company secrets. Wipe it and tell people to trash the machine as e-waste or send it back, it doesn't matter anymore.

They can't remote wipe it if you don't connect to the internet.

Which is why you have short lived (less than a week) certs that have to be renewed only by access to the corporate network before you can even power on and unlock the machine's drive encryption.

Not sure if it's the case with Shopify, but at big companies I've seen agreements with regulatory bodies and court legal holds that require the company certify that it's retained every scrap of employee data so that it's available for discovery later. The company can try to do this by uploading the entire contents of the laptop/phone to the cloud periodically, but they still don't retain 100% unless they do it once more at the very end and then hand the blank device back to the former employee. With layoffs involving thousands of partially-remote employees, that may not be logistically feasible and cheaper to just buy everyone a new device.

I don't know why people even care about that. I go out of my way to not use my work laptop for personal work/projects/etc. Especially considering the amount they value the laptop at (which may be inflated) is deducted from your severance payment

I think a lot of people dont bother getting their own laptop and are then in a bad spot. That said thats their own bed made.

From my experience, not many people set boundaries between work and personal tasks and the number of people who have personal software projects outside work is tiny.

I too am guilty of using work laptop for personal work like shopping etc couple of times.

Personal anecdote:

one of my colleagues was recently discussing about replacing his 6 year old laptop that he rarely uses, one of our architects commented : "I don't understand why anyone would need a personal laptop at home. We can use our work laptop for anything that our mobile can't do". I was surprised to hear that from an architect and even more surprised to see many others nod in agreement.

Edit: fixed a typo

On the one hand, having complete separation of work and personal electronics is a best practice. On the other hand, most of us don't carry two phones or two laptops when we travel on business.

If I were a senior government official or in some other high profile/sensitive role I'd probably be more conservative but it's pretty common to use some combination of personal and business-issued devices for everything.

I think it is not about specific law targeting laptops, but they might be legally obligated to protect their IP and business secrets i.e. source code, credentials and the documentation etc on the company owned devices.

If they give away the laptop, it will be difficult to guarantee and verify that the data is wiped out entirely within whatever time frame they are aiming for. So, they want their property back.

Shopify is a Canadian company, Canada has laws around if you do work on your own hardware vs company hardware being what classifies you as a contractor vs an employee. If I had to guess, I'd imagine the lawyers are worried employee classification based on hardware.

Being in a layoff cycle at one of the biggies they scraped all of our laptops and refused to sell or give them away, with the reason being that it's too complicated to come up with the proper process to do that properly.

If you're affected by a layoff anyway... raise a stink at the media, can be pretty effective if the company has a "sustainability" code of conduct.

Lol… it will have to be the slowest of slow news cycles before wasteful corporate IT gets any press. To the average person it’s information about paint drying.

This is especially true for Apple laptops, where the transfer of ownership is complicated (to protect against theft). I saw Lenovos and Dells being recycled in corporate settings but never Macs.

I recently negotiated terms on behalf of a group of laid off employees, and one item I pushed on was that they get to keep their laptop. The company said that wouldn't be possible for everyone, because many laptops were leased, and so were not the company's to give. In those cases, they would be given a different but equivalent device.

Lots of possible reasons.

It could be for be contractual reasons: for example, employees might have proprietary licensed third-party data or source code checked out in a local cache somewhere, and IT needs the laptop back to verifiably scrub the hard drive.

Data privacy and protection compliance, specifically for devices that may have accessed customer data.

shopify*

Whoops, you’re right. I’m past the edit window though.

Reply on news.ycombinator.com