Developer sentenced to prison for activating “kill switch” to avenge his firing
arstechnica.com
arstechnica.com
Morality aside, that’s kind of hilarious.
Regardless, it should be pretty obvious that if an attacker gains RCE, they can do a lot.
i regularly see orgs with orphan machines running that no one understands or wants to touch
How crazy would it be if he were framed.
We have an outright criminal at the top, healthcare CEOs can kill you with Excel by the tens of thousands, but a company loses some money and the rules suddenly apply?
What an absolute joke.
Punishment, not justice!
This seems like the only thread so far on this discussion where commenters have a sense of human-centered morality. And it's far fewer posts than the others. It really feels like corporations, greed, money and power have won..
Obviously don't do this, because you don't want to be more morally bankrupt than your employer, or your whole argument of righteousness falls apart. The morally righteous never would, because they already know that employment in the US is voluntary for both sides. Also, over time, one would absolutely forget to disarm it.
There is one exception. It is when the code has no type definitions and obfuscated variable names, or worse yet, has incorrect type definitions and misleading variable names, but such code is not maintainable at all anyway, even for oneself.
In summary, even for the author to understand a codebase over a long period, it has to be well organized because human memory doesn't recall all the little details.
>Ranked #4 in "100 Best Corporate Citizens" of Corporate Responsibility Magazine in 2013, also ranking in Top 50 for Six Consecutive Years.
Fucking bozos!
Tinley plead guilty and got 6 months.
https://www.zdnet.com/article/siemens-contractor-pleads-guil...
If I was expected to be available all the time, you can be damned sure I would have expected to be paid by the hour for that.
That being said, answering anything work related outside of work, unless they are your truly close friends is lame and considered a character weakness, to be abused. And don't expect any extra bonus points for that.
Having a good private (aka actual) life you are willing to defend ain't a sign of weakness, in contrary.
Mine just stays on my desk when working and goes to a drawer when not. It is basically just a 2FA device. There is nothing to lug around.
And that’s fair. But I don’t want that on my personal devices. It’s literal spyware.
If work wants that level of control on my phone, they can just give me a phone they own outright. I’ll give it back when I’m done working there.
Seriously, it’s a huge mistake to mix personal and professional data on any device. Too many risks I want nothing to do with.
When I was younger I would answer calls and emails outside of work hours, because I wanted to be a Good Employee, but it's a huge mistake because management (and sometimes coworkers) will exploit it and after a while expect you to do it. Set hard boundaries immediately.
You absolutely want hard physical separation between personal devices and company-controlled business devices. That means two phones and never allow control to cross those boundaries.
After work, I put my work phone away. I have been in this industry for over a decade and I wouldn’t have it any other way.
I will never let an employer steal time away from my family again. Especially now that they want us all to RTO. Office time is theirs, home time is mine.
Makes it real easy to control how available I am to different groups of people.
Anyone who cares about privacy and control of their personal life.
He gets points for style. But this is novel behaviour that has to be discouraged.
Damage is a funny word here. Yes - money was lost, but no building were destroyed, nor people physically harmed. “Actual damage” makes it sound like a lot more than lost time and a few extra contracts paid out.
Yes, yes, criminal law and civil law are two different things and statutes can allow or require imprisonment in a criminal sentence. But we are discussing what is morally appropriate punishment for this misdeed, not what current law allows.
If I had a business its finances would be separate from my personal finance using limited liability, so even if someone destroyed 100% of its value, it would only be no return on investment for me - sad and bad but totally not equivalent to losing all my personal money.
But yes, I am arguing that four years of prison time (there’s also three years of supervised release - so seven years of court oversight total) is disproportionate punishment, and probably any prison time at all for this act. Prison makes the most sense for violent criminals.
I am fine with lots of other compensatory and punitive consequences, including the criminal conviction itself which should not be underestimated as a public record visible in background checks, at least some kinds of orders restricting future activities with computers and/or his former employer for a suitable duration, plus whatever monetary consequences are deemed appropriate.
How much money would someone need to cause in damages to you or your loved ones before you change your tune? Steal your car? Your home? Your parent’s retirement? It’s just money!
There are lots of better ways to punish this kind of crime, generally. Imprisonment doesn’t get my money back, is expensive for the taxpayer, is at least as likely to make the criminal more prone to reoffend as less prone to that given how typical American prisons work, and isn’t necessary for either retributive or deterrent purposes.
Their criminal record, any court order to pay compensatory and punitive damages, any loss of their own property or bankruptcy that results, and so on would be plenty of retribution and deterrence.
Now, if they try to flee from justice or violate court orders or hide assets in ways that imprisonment would usefully interfere with, that’s a different question. Prison makes sense in many cases, but merely making the victims of a nonviolent monetary crime feel satisfied is not inherently such a case.
They’re gonna keep doing it.
I don’t see signs of that in the case we are discussing. This crime was a crime of opportunity against a large corporation causing only monetary harm to the corporation in the form of inconvenience and time wasted for its employees to clean up the mess, but not ruining anyone or anything beyond coworkers’ account profile settings, not even anyone’s paychecks.
Certainly this case was worthy of punishment, definitely worthy of the felony criminal conviction and potential damages if the employer wants to sue or if this criminal statute lets the court include that in the sentence, likely worthy of temporarily or permanently keeping him away from employer computer systems beyond something heavily locked down (e.g. point of sale screen), and maybe also temporarily or permanently away from computers or the internet in general if that won’t unreasonably prevent him from having some viable way of making a living, but not worthy of imprisonment without more reason for that.
I suppose it's a philosophical difference...I just hope that you appreciate how extreme the position is. The amount of fraud in this country is disturbing and I don't think it is compassionate/kind at all to keep these people out of prison while most people are struggling to make an honest living. It creates a moral hazard.
I just don’t equate punishment with prison. I realize that the best kind of punishment isn’t always having the taxpayers pay for years of that person’s food and lodging, depriving their innocent relatives and colleagues of the emotional/family presence and professional labor/earnings of someone who may have been very noncriminally important to them in many ways outside of prison, introducing them to the many gangs and violent criminals that populate US prisons while simultaneously subjecting them to a traumatic change in life circumstances, turning them into low-paid involuntary workers for wealthy capitalists to profit from as is done in many privately run prisons pursuant to the exception in the Thirteenth Amendment, and so on.
Nothing I said is true only for the financial or white-collar criminal. In particular, poor brown or Black drug users are way over-imprisoned and that shouldn’t happen either. I’d actually rather harsher punishments for the financial white-collar criminal than for the poor minority drug addicted, but in most cases neither should involve prison.
Prison is clearly necessary in some cases and arguably necessary in others, but it shouldn’t be our first thought of how to punish a criminal - whether white-collar or blue-collar - especially not the way typical US prisons work.
The company can still sue for those damages, and they can take all the findings of law and findings of fact from the criminal case as already proven without having to reprove those.
Even if you had not said that, your argument ignores my point.
I don’t think I am. You argued against compensation and damages, which are not at all ruled out by the prison sentence, and said you’d seriously consider the prison time if given the option.
I assume mean that you’d consider the prison time as an alternative to the compensation and damages, but that’s not what happened here. Did you actually mean you’d consider the prison time whether or not the company could still sue you in civil court for damages and whether or not the criminal sentencing court could also order financial restitution?
If so, I guess I did miss that implication, but it seems unlikely. Maybe you would want the free lodging and food in that scenario due to the career and financial difficulties that will result from this, even if the free options on offer are a prison cell and prison food?
I think very few people with a spouse or kids (or elderly parents) depending on them would make the same choice, but I can see how some young single people might.
This is called wage theft and I haven't seen anybody going to jail for it.
I don't condone what this person did, but I wish justice was as swift for crimes committed by the rich and powerful.
And generally, the scale of the damage affects the punishment.
> “Do you understand what I'm saying?" shouted Moist. "You can't just go around killing people!"
> "Why Not? You Do." The golem lowered his arm.
> "What?" snapped Moist. "I do not! Who told you that?"
> "I Worked It Out. You Have Killed Two Point Three Three Eight People," said the golem calmly.
> "I have never laid a finger on anyone in my life, Mr Pump. I may be–– all the things you know I am, but I am not a killer! I have never so much as drawn a sword!"
> "No, You Have Not. But You Have Stolen, Embezzled, Defrauded And Swindled Without Discrimination, Mr Lipvig. You Have Ruined Businesses And Destroyed Jobs. When Banks Fail, It Is Seldom Bankers Who Starve. Your Actions Have Taken Money From Those Who Had Little Enough To Begin With. In A Myriad Small Ways You Have Hastened The Deaths Of Many. You Do Not Know Them. You Did Not See Them Bleed. But You Snatched Bread From Their Mouths And Tore Clothes From Their Backs. For Sport, Mr Lipvig. For Sport. For The Joy Of The Game.”
Death speaks in ALL CAPS.
Death's bosses speak in italics.
I. Gods speak in
II. Commandments
The character speaking in the above quote is Dorfl, a golem, who speaks in Title Case.
I feel like 2 years would have made sense to me.
Mugging is “almost a victimless crime” by that standard.
And this was significantly more victim-ful than that.
From a Danish perspective I think that this is rather cruel.
As for the up/down votes, I have them disabled so I don't know nor do I care about them. I actually should write that part in my signature.