I was authorized to trash my employer's network, sysadmin tells court

Lets be honest though..

who at least hasn't at least once in their life wished they could do something like this to some sh*tehawk of an employer who is royally shafting the staff left, right and centre?

Of course, as a System Administrator, he had "authorization" to manage the information systems, however, his job was not to damage the systems he managed, mismanage those information systems, or otherwise cause harm to them, so his argument that having access privileges to manage the information systems gives him free reign to cause harm to them, is without merit. If he wins this case, it's not because his assertion that having access and privileges to manage information systems gives him the RIGHT to mismanage and cause harm to them. This is a daft argument that will fail the rules of law, unless the judge is daft.

If Thomas is found to have acted with authorization, every company will wonder if that gives their sysadmins carte blanche to ruin their systems with no legal comeback. That's not going to sit very well in boardrooms.

Or just to use different legislation. I suppose it depends on the exact wording in your jurisdiction, but what he did would be equivalent to trashing the office on your way out - destroying furniture or putting a printer through a window.

It becomes a criminal damage charge rather than an unauthorised-access/computer-crime/"hacking" charge.

That said, I'm surprised there isn't a straight up clause in his contract to do with gross negligence or wilfully acting against the company's best interests or conduct which wilfully jeopardises operations.

very possible this could have even further implications.

it is a stretch but if a hacker gains access to a system at that point he/she is the admin with the very same rights this person claimed.

like I said, a real stretch but...be wary of the rulings on thi sone.

"the whole of Monday sorting out"

Oh my heart truly bleeds.

Stupid defense.

Having keys doesn't authorise you to burn down the house.

Double Standard for Directors and Employees

After reading the comments I am surprised more haven't pointed out that Directors of companies regularly (and these days often) take actions that are damaging to the company. On occasion they openly state their damaging intentions to local media. An example many reading this have seen is a profitable company "locking" out it's workers in an attempt to make the company even more profitable, sometimes so it can be sold (though they never tell the media that). We all know of such examples, even some resulting in a total loss, with equipment being sold for scrap and leaving the clean up to taxpayers.

Yet criminal charges are rarely if ever laid.

Even when Directors or company owners have openly acted to intentionally cause damage they always claim they had authorisation, even when such actions cause the failure of global financial systems.

In this particular case the company acted criminally when it attempted to defraud an employee, and now wants the government and courts to cover the unforeseen consequences of that criminal activity. Only business is allowed to use the courts in such a manner. If you think the legal system helps peasant criminals in their activities look at the unsolved murders in your area.

Charges against Mikey should be dropped for that reason alone but IMO it is better to have it go to appeal so it can be made clear that Employees must be given clear directions, that each position be required to have a full description of the role and responsibilities, with limits and expectations and that the pay and compensation be equivalent to the level of responsibility being assigned. If you are the IT department, you are an executive and equally immune to being held responsible for your actions.

Sounds like this company wanted it cake, dumping full responsibility and duties, and eat it too, paying only IT rates and being able to abuse employees at will.

To do this damage as a hacker is a criminal offence, however...

...to do this as an employee with full access to those systems makes it a civil offence NOT a criminal one.

If I were on the jury

I'd still find him guilty. But I'd reduce the monetary damages.

The company obviously failed in their fiduciary responsibility to him as an employee. That nullifies his fiduciary responsibility to them. Perhaps not as a matter of law, but as a matter of principle.

Yeah. He did an illegal thing. He spent time in jail already. I'd leave it on his record for being a dick, and a criminal. Good luck finding another job, asshole. But I wouldn't reward the company 130,000 for their part in this mess, either. $1 is more like it.

Criminal or civil action

if he was convicted in the criminal sense - i.e., a law that intends to protect computer users/owners from abusive behavior/actions from an individual.

In short, this case will live and die by a strict discussion of the word "authorized" - to be or not to be.

I doubt anyone will not see this as "wrongful" as it shows a behavior that most would consider outside the bounds of the "authorization".

A different example: a police officer is authorized to carry and use a firearm. However, his "use" of the firearm, while also "authorized" is also subject to review to determine if he abused the authorization granted.

If the current, or past law, that was used to charge the admin lacks a directive for review - the law is broken and needs an update. I expect, regardless of the outcome of this case such a review is forthcoming.

And, of course - even if the appeal says he was authorized - in the legal sense - I would not feel safe, as a civil case can still be opened. Actually, surprised if this has not already been acted on.

My two cents.

sounds like a proper hero to me....

but what i dnt get...the fired employee.....why and how on earth would he geta share of the profits simply because he was the first employee? that makes no sense to me...surely the first employee would be the owner/s anyway.....? i.e. employed by themselves...

Best advice ever.

Don't treat your employees like shit

Something we can all agree on.

Intriguingly

This is exactly the argument for not overworking staff in the first place.

I'm not condoning his actions but, if the backups contained information that if it were leaked (this is comparable to shredding of unwanted documents BTW) would have brought down the company, the case should be dropped on the grounds of technicality.

Recall a similar case where, months after being "terminated" a copy of the cooked books in the form of a handful of CDRs was delivered anonymously to the IRS resulting in the Audit-from-Hell (tm) and several high profile plea bargains. Pretty sure this resulted in jail time for the executives and a job at the IRS Investigations department for the IT person in question.

So what?

It actually won't be that big a deal if he wins. Sure, criminal charges would be out in the future, but so what? Most fines go to the government, and you have to sue in civil court to get damages anyway.

They'd still be able to sue him on the grounds that no reasonable person would think he was hired to destroy the network, and they would win, and he'd have to pay for the cost of fixing the problems he caused. He wouldn't go to jail, but so what? Sending him to jail just means that a portion of the company's taxes will be paying his room and board for a period of time. Taking his money and destroying his reputation so he can't get another job is far more cost effective.

More to the story

There is more to this story than can be covered in an article I think. In the US appeals are decided by a panel of 3 judges and are based on a cold reading of the record and the law. In this case it has nothing to do with intent, malicious or not, but whether authorization to cause damage existed - which he had. Damage under the CFAA is defined essentially as any kind of change. 'Without authorization' in the CFAA isn't defined and has been interpreted different ways by different courts. In the US there is something called the rule of lenity that says when a criminal law can be plausibly interpreted multiple ways, the court is required to take the interpretation favoring the defendant.

As some of the comments here have pointed out this was the wrong law to charge Thomas under, if charges were even warranted in the first place. Assuming there was even a violation of some kind of company policy, it is not permissible to base criminal liability on a private policy/contract. That would make the law void for vagueness as private parties would then be making decisions as to what is and is not criminal. The trial court judge and the prosecution here went to great lengths to make a square peg fit in a round hole here, applying a law that wasn't meant to be used in this scenario.

I am sympathetic to the sysadmin here after reading his legal defense fundrazr page. He worked over a weekend to keep the companies systems functional, after his buddy had been fired, then resigned without notice when he decided he'd had enough. The company owners were pissed that he quit when there were still network issues and decided to try and ruin his life by maliciously hiring attorneys to sue then get the Feds involved to prosecute him (rather than the state). Left out of the story is the fact that the company filed a civil suit initially, then dropped it a few months later. Also that most of the 'damage' alleged to have occurred arguably falls within normal troubleshooting processes based on the things that were happening that weekend. Or that the government froze all of his worldly assets, which were not tied to the alleged crime, and listed him on Interpol's website after charging him - stranding him in a foreign country and preventing him from being able to hire an attorney for years. How about that the $130k restitution figure is based on paying people to do his job for the next 18 months after he quit, or that the jury was hung 6-6 on the case after deliberating two days and only returned a guilty verdict when the judge refused to let anyone go home and return for a 3rd day of deliberations (because he wanted to go on vacation the next day). Maybe that the employee handbook he is alleged to have violated was never produced at trial, only an acknowledgment of his receipt of it, which specified violations could result in disciplinary action "up to and including termination". Also that the government wanted him to go to prison for 3.5 years but the judge released him after only the 4 months he spent awaiting trial and sentencing.

People don't seem to comprehend the toll that a federal criminal prosecution takes on someone, even if they win. They don't 'walk' or 'get away' with it. Being charged at that level for something that could result in 10 years in prison, under a system that is stacked against defendants, where 90% of cases plea guilty to reduce sentences. Where trials typically cost hundreds of thousands of dollars and face bleak odds of winning. Even if you win, you still lose. Criminal CFAA cases are very rare, ones that go to trial and appeal are even more so. This is a rare and important case that will help clarify the law. If his conviction is overturned it may curb future overreach by prosecutors who want their names in the paper, if upheld it will mean employers can retroactively rescind authorization and have employees prosecuted for anything they please.