Why screening employees is important

[BeeMused]

<bg> We make all sorts of adult toys. We get the raw materials (medical grade silicone and pvc etc) from company A. They have been great when we started our production, helping us to find the right mixtures etc. While they aren't the cheapest, they are reliable and will deliver on time, and the quality is outstanding.
We never had any contact with company B.</bg>

Two weeks ago the production manager came into my office with some sheets in his hands.

PM: This is what company A sent us last month...
Me: Uuuh, this is their regular price list?
PM: Yep! And this is what company B sent today!
Me: WOW this looks like an exact copy! The prices are different, though.

They hadn't even bothered to change the layout! The PM had entered the prices from both lists in an excel sheet and found that company B's prices were exactly 1% cheaper, all of them!
I decided to call the boss of company A, who told a horrible story. Someone in his company had been selling data to company B. Currently they were working with the police to find the culprit and to kick company B's ass.
Last Friday I learned they had found the guy, he has a gambling habit and is in so much debt that he stole the data. As an IT guy he had access to everything. And now the real kicker: Company B had apparently phoned around all IT departments of all their competitors to find someone willing to sell.

[Andara Bledin]

Yegods!

Company B needs a good blacklisting in the industry.

^-.-^

[tropicsgoddess]

The guy that stole Company A's data is really gonna get raked across the coals (legally among other things) and I can bet the OP's boss will consider some confidentiality agreements and screenings for prospective candidates/employees.

[BeeMused]

Yegods!

Company B needs a good blacklisting in the industry.

^-.-^

Oh yes! It's already happening. Us bosses talk to each other, you know...

Company A will sue their ex-employee and company B for damages, not to mention the criminal charges. So far this hasn't hit the press, and company A wants to keep it this way.

[Flying Grype]

I'm curious about what they would have screened out, though... if he had a gambling addiction and debt, and they'd found that out before hiring him, would it have been justifiable not to hire him for increased potential of future financial crime?

[BeeMused]

I guess they would have been more reluctant to give him full access to all data as an IT Admin and might have watched him a bit closer.
I have to admit, I'm not sure what I would do. People need access to critical data to work properly, but there always is a risk involved. So far I can say my employees are very loyal, thus I'm not worried.

[Flying Grype]

It just seems like punishing him for a crime that he didn't commit. Financial irresponsibility up to and including gambling addiction is not itself a crime. There are people in that situation who get help, smarten up, and fix their debt problems legally.

[BeeMused]

True, being in debt is no crime, but it's a vulnerability and would prevent you from getting a security clearance, I guess.

[houdini]

True, being in debt is no crime, but it's a vulnerability and would prevent you from getting a security clearance, I guess.

It's not a problem as long as they know about it, and you're paying it off. It's unmanagable debt that's the vulnerability.

Apparently you can get high level security clearence in the UK after having done all sorts of illegal shit - they don't care, they just want to know so that no one else can blackmail you!

[Teskeria]

Nothing will happen to the thief as companies do not like to prosecute. They think it makes them look bad when people find they were stolen from. Personally, I would want to know that they prosecute the hell out of thieves like that. It would discourage a lot of them and only the hardcore or desperate will be an issue. Heck I only know for sure of one credit card company that prosecutes when they are able to ID people committing fraud.

[bainsidhe]

They think it makes them look bad when people find they were stolen from.

Yeah, this is what I'm wondering. I'm sure it wasn't just a pricing structure that was stolen, otherwise Company B wouldn't know juuuuust how much to reduce the OP's pricing to be competitive. I'm sure it compromised tons of customer and other proprietary data.

[BeeMused]

Yep, they got a copy of the customer database, too. So they knew what we when ordered and what we paid.

Anyway... company B is toast. Rumour has is that the owners have left the country and there's no money to pay the employees or rent or anything.
There will be prosecution, I'm not sure whether that stunt will earn the IT guy some jail time or just a heavy fine, but if they find the <expletive deleted> owners of company B, I'm sure they will end up in jail.

I guess all the companies in this industry know about this mess by now.

[PepperElf]

Yep, they got a copy of the customer database, too. So they knew what we when ordered and what we paid.

Company A may have a hard time keeping the lid on this one then.

Aren't they legally obligated to let their customers know that their data was compromised?

In fact, A's customers could in fact sue A over this as well....

[Geek King]

In fact, A's customers could in fact sue A over this as well....

They could sue, but I don't think anyone who did would get very far. Theft by someone with access levels of a high-end IT professional isn't something you could reasonably predict or prevent. Lord only knows what havok I could cause with the stuff I can get into in my job. Part of the job calls for a good deal of trust--you live or die by reputation and a clean record. Unfortunately, it sounds like company A fell victim to a bad personal habit and weak personality.

[PepperElf]

Well... not so much over being something you can predict but... the fact their data was compromised at all, A may legally be required to notify their customers of the situation if nothing else.