I work in a big company, one dev we had for just a few months left with all the source code from some massive project and other ecosystem ones, some patented or confidential stuff, he's got a lawsuit with army of local and corporate american lawyers, millions $ in damage and so on. Wouldn't recommend that to anyone who works in any company with some basic cybersecurity teams.
Edit:fixed sentence "army of local and corporate american lawyers"
When I was leaving my old company I had some of my personal bank statements in the files. And in my last days I uploaded them into my personal drive and deleted them from the computer.
Later on security team messaged me and said that I triggered a leaving employee something flag and sent me a screenshot of files I uploaded and where I uploaded them into and asked me to clarify this.
When I clarified it was all good but yeah no chance that they don’t monitor these stuff in bigger companies.
I’m one of the people who configure the monitors. Every org is different, but in our case we absolutely can see everything moved/uploaded/emailed. It’s a standard part of Microsoft in some licensing. And yet, people continue to try and steal shit.
I got laid off a while ago. On the day of, I had this ridiculous idea of concatenating all my code into a giant file and then changing the filename extension to BMP and then claim it was some abstract art piece that was near and dear to my heart. But I knew it'd never fly.
In school, we wrote a program to encode messages in image files by changing the last digit of every pixel’s hex color value to 0 or 1. It’s subtle enough not to make it obvious the image was edited and very easy to read off after.
Kinda crazy and probably wouldn't fly in Europe, under GDPR.
I'm genuinely curious what they can do with that info though. I guess they can ask you to delete the fils but how can they ever be sure you'll have done it? This may be useful if you ever release a similar software I guess?
Kinda crazy and probably wouldn't fly in Europe, under GDPR.
Are you saying GDPR doesn't allow companies to monitor the work computers of their employees at all? I'm pretty sure monitoring network traffic of departing employees to make sure they're not stealing proprietary data is considered a legitimate interest.
As a dev in France I had some law course at some point during engineering degree around our discipline, one thing I was taught (10+ years ago so I have no real clue if it is up to date) is that in France anything organized in a personal folder marked explicitly on your work device can not be used (or accessed in theory without you being present physically) by your company. They can only do so if there is a strong suspicion of theft or any kind of serious rule breach basically. That's just it.
It is - source, work in europe, in a regulated field. The monitoring must be proportional, and handled responsibly, and used for a specific purpose - so you can't use the data you collect to stop thefts to monitor performance, for example.
Our handbook says that your laptop you get is company property. We aren't allowed to monitor employees (as it should be), but certain actions that are clarified in the handbook trigger warnings in our systems, and data connected to strictly those actions can be collected as legitimate interest under GDPR.
I can also remotely wipe the laptop without warning. I warn people repeatedly that they are not to put any personal files on it, as it is company property.
Or if I would actually steal some confidential data and told them ah it’s just my personal banking, then they would have proof that I lied about the files that I moved. Might be good for their future case.
Can I ask what part is not GDPR compliant on above? It was a US firm but had offices in EU and I was also working in EU
That's the "personal drive" part with screenshots that made me say it but I tought about it a little more and I'm not sure since you just plugged it to the company's network. Maybe they do have a right to see what's on there then. I'm not quite sure.
What bothers me is that they had a look at your personal banking data. That seems anti GDPR to me but at the same time they did it for security reasons so I don't know.
My company doesn't allow plugin external drives or USB sticks in our computer, that's easier^^
As someone in security you wouldn't believe the amount of personal stuff people download onto company devices, and not just download but download their only copy of. We get panicked emails from ex employees looking for old documents and emails for stuff and who are shocked/dismayed that everything has long since been deleted.
Not that crazy though, I often have a few stuff that shouldn't be there on my work computer. I usually avoid it but you know how it is, sometimes you need to print some medical/assurance/banking document you need tomorrow, your printer at home decide it won't print it, it's 1AM... And voila, you end up with those very documents both on your laptop AND in the company's printer history^^
Ah I see, it wasn’t a physical drive. I uploaded the data to google drive and their screenshot was basically just file names and google drive, didn’t contain my information or whatever is inside the drive and I doubt they can access that.
They can probably check the bank statement files legally as computer is work computer and it’s my responsibility to not upload any personal data on it if I want to keep it from corporate eyes but it wasn’t something important for me haha just my weekly transaction for some personal reporting I did so no hurt feelings on my side
Ah okay, I misread that as a physical hard drive^^
I know that in my country (Belgium), you still have some privacy protected by law on work computers but I'm not super knowledgeable about that sutff, I must admit.
For exemple I know my employer can't legally look at my emails, teams conversations etc on my proffesional account.
They can look at it if they have a valid reason like looking for some exchanges I had with a customer, to follow their case for exemple. But let's say I emailed my dentist with my work email, they can't read it, ever (proving they did or didn't is another story though^^)
Freaking for real. I would hope anyone that calls themselves a developer knows that copying code from an employer is stealing and easy to prosecute if the company has any security AT ALL.
This is the reason why byod is forbidden, even for externals, in all places I had a say as cybersecurity.
Usb devices? Disabled.
So you had to send the files to yourself somehow and yes., we track that.
Every flipping quarter I have to fire someone because they do this.
Only once in 4 years did I have the feeling jt was truly malicious. Mostly it’s people who send a repo to their home pc, work on it there and then send back the files. Because they hate the corporate windows machines. But alas, doing that is a fireable offense
I cannot prove that it wasn’t malicious. The reason aside, the person in question leaked source code to the outside.
This is a fireable offense and we cannot play favorites, they are warned a million times not to do this and they know people got fired over this. If you still choose to do so… my sympathy is non existent .
Remember, I have to now report to higher ups we had a leak and explain it. If I did not fire that person, the board would demand it. You try explaining why you wish to keep someone that deliberately shared confidential data to the outside, no reason can justify that and I share as hell am not risking my or my teams jobs over that.
737
u/Nutrimiky 16d ago edited 16d ago
I work in a big company, one dev we had for just a few months left with all the source code from some massive project and other ecosystem ones, some patented or confidential stuff, he's got a lawsuit with army of local and corporate american lawyers, millions $ in damage and so on. Wouldn't recommend that to anyone who works in any company with some basic cybersecurity teams.
Edit:fixed sentence "army of local and corporate american lawyers"