Generally a firing is decided the previous day or at least an hour before it happens. Discussions are made prior to the actual meeting where the firing occurs. IT is on standby. They either deactivate the AD account and related auth methods when the employee walks in the office to have the discussion. This is a well oiled machine, so that all parties know their parts. The meeting/discussion is solely a formality and by two minutes into it, theres no longer any access granted. Security shows up at the meeting to escort the employee out and collect their badge or keys. Maybe they let the employee walk by their desk to collect their stuff, maybe the employer ships it to them later, depends on the circumstances and office layout.
In well-run orgs, yes. Most places are not well-run.
bilb@lem.monster
on 11 Jun 2024 21:36
nextcollapse
I was let go somewhat recently and I noticed just yesterday that I still have admin access to their facebook app.
Sonicdemon86@lemmy.world
on 11 Jun 2024 22:00
collapse
Time to get busy and say it’s a pen test of their systems.
KISSmyOSFeddit@lemmy.world
on 11 Jun 2024 22:26
collapse
At my last job I was informed that I’d be terminated, then had to work normally for another month (the termination period), where I still had full domain admin access to all our own and our customers’ systems.
On my last day I myself had to write down a list of all the logins I had and give that to my boss, because no one else knew what accesses I even had.
During the last hour I wiped my own company PC and gave back all hardware I was given. Again, there wasn’t any record of what I was given over the years so they took my word for it. This included unencrypted USB drives with sensitive medical data on them.
As someone who worked for German, as well as North American companies, your experience is not the norm in NA. Wish it was.
Potatos_are_not_friends@lemmy.world
on 11 Jun 2024 22:15
nextcollapse
Last year, I tried my admin creds at my old job and it still worked. I was afraid of retaliation so I sent them a message from a throwaway email about changing their passwords.
KISSmyOSFeddit@lemmy.world
on 11 Jun 2024 22:30
collapse
Legally, it would have been better to send the mail from your personal account.
Otherwise there’s a possibility that something happens to get fucked up right around the time you logged in, they pull the logs and find your access.
Bam, motive and opportunity, and no way to provide an alibi.
Pacmanlives@lemmy.world
on 11 Jun 2024 22:17
collapse
I mean kind of depends. I got a soft layoff so worked 6 months more and got 3 months pay for the transfer to India.
I think best practices for highly secure environments is at the time of notice you lock the account and give that person 2 weeks off.
Most normal company’s it’s cool work till your last day, do your exit interview and we lock your account on Friday afternoon or Monday
Also you never want to change someone’s password on termination. What if their login is running some business critical tasks? Not best practices but I can tell you it happens a lot especially for reporting. If you lock the account you can always just reenable it and work to fix the issue
andrewta@lemmy.world
on 11 Jun 2024 16:36
nextcollapse
He didn’t hack anything. He used a password that wasn’t changed.
Land_Strider@lemmy.world
on 11 Jun 2024 16:53
nextcollapse
Which was also used repeatedly over the course of 3-4 months to gain access via a non-corporate laptop without the IT doing anything about it.
Omgboom@lemmy.zip
on 11 Jun 2024 16:55
nextcollapse
Yeah that seems pretty negligent on their part.
Zer0_F0x@lemmy.world
on 12 Jun 2024 09:41
collapse
I’ve been in IT for a few years and I’ve changed companies a few times.
I just checked my login creds for various systems of 3 previous employers and like half of them still work.
Unfortunately it’s a lot more common than any IT department would like to admit
cyberpunk007@lemmy.ca
on 11 Jun 2024 20:51
nextcollapse
Technically he was not authorized to use the computer system due to his termination which the law looks at and calls hacking.
andrewta@lemmy.world
on 11 Jun 2024 21:52
nextcollapse
I’ll give you half a point because technically you are right.
KISSmyOSFeddit@lemmy.world
on 11 Jun 2024 22:19
collapse
No, the law specifically called this “unauthorized access to computer material”. It’s right there in the article.
cyberpunk007@lemmy.ca
on 11 Jun 2024 22:48
collapse
I said the law looks at whether it was authorized access or not, I was not citing any literal lines from the law. Didn’t read the article because I know this already because of the industry I work in and I took a course a number of years ago that literally was about this.
kibiz0r@midwest.social
on 11 Jun 2024 21:56
nextcollapse
It’s only hacking if it’s in a CVE.
Anything else is just sparkling unauthorized access.
Landless2029@lemmy.world
on 12 Jun 2024 05:28
nextcollapse
rekabis@lemmy.ca
on 12 Jun 2024 00:03
nextcollapse
NCS is a company that offers information communication and technology services.
Wait…
he used his laptop to gain unauthorised access to the system using the administrator login credentials.
Okay, what the guy did was immature and shitty, but holy hell this company is incompetent. How did their own internal IT not lock him out of anything even remotely sensitive the moment he was fired?
punkwalrus@lemmy.world
on 12 Jun 2024 01:40
nextcollapse
Probably HR (or the NCS equivalent) never told the right people. I am not saying this is actually what happened, but a lot of IT bemoan the fact they are never told some rando employee was fired because HR neglects to inform them. Sometimes it takes months to discover, and even with a 90 day password/login lockout, some halfway decent admin could get around this by secretly building a back door, and using the messed up communication and politics between departments to hide this. Even in the 1990s, I saw people put in “time bombs” in their code that “if such and such is not updated in 6 months, run destructo-script A.”
But imagine someone like Kandula Nagaraju here. Worked in QA, probably did a great jobs with some skills, but had the personality of swallowing broken glass. He was terminated in October 2022 due to “poor work performance,” which could mean anything. “Not a team player.” Or maybe he really was an idiot: I mean, a smart person would have a conniption, but get employed elsewhere and then slam his former company at parties. “Those NCS folks didn’t know what they had with me!” But this guy was probably someone with some anger management issues, probably a jerk, and possibly stupid. He might have had revenge fantasies, and set up a small virtual server posing as a backup code mirror. But outside the audits, it allowed ssh from the outside, and hid it through a knockd daemon. Or maybe only launched ssh at certain hours before shutting it down again. Silently working away in a sea of virtual servers with little to no updated documentation. He gets in, has internal access, and runs a script with admin credentials because they don’t rotate their AWS keys/secrets quickly enough. Or didn’t even know he was let go.
After Kandula’s contract was terminated and he arrived back in India, he used his laptop to gain unauthorised access to the system using the administrator login credentials. He did so on six occasions between Jan 6 and Jan 17, 2023.
That’s embarrassing to the company. Not only did he get in, but SIX TIMES after he was let go. he probably knew what order to run the delete commands (like, say, an aws “terminate-instances” cli command from a primary node), and did so one by one, probably during hours with the least amount of supervision, where the first few alerts would take hours to get someone in the monitoring chain to wake an admin. Given his last day was in November, and he got back in January, the admins probably thought their 90 access credential rotation was “good enough,” but he got in on his 80th day or whatever.
I know this because I have had to do triage when a former contractor did this to a company I worked for. But instead of wiping out instances, he opened a new set of cloud accounts from the master account, put them in an unmonitored region (in this case, Asia), and spun up thousands of instances to run bitcoin mining. Only because AWS notified us of “unusual traffic” were we made aware at all, and this guy knew his shit and covered his tracks very well. He did it at a speed that could have only been automated. Thankfully, AWS did not charge us the seven figure amount that this activity amassed in just three days.
bitchkat@lemmy.world
on 12 Jun 2024 03:33
nextcollapse
If its the NCS (National Computer Systems) that was bought by Pearson a few years ago, then what they sell is the hardware/software that reads all the “fill in the circle with a #2 lead pencil” forms.
trolololol@lemmy.world
on 12 Jun 2024 09:35
nextcollapse
I’m going to take a guess this is the guy that removed access from fired people under hr request, for $999.999
ours@lemmy.world
on 12 Jun 2024 09:58
nextcollapse
I’ve had people above me fired in a startup and I was asked by the board of the company to lock their accounts and seize their professional laptops while they were in a meeting informing them they were fired.
The idiots had tried to stage a “coup” against the CEO which failed spectacularly.
funkless_eck@sh.itjust.works
on 12 Jun 2024 14:57
collapse
in my org it’s a single process to deprovision someone of access to all tools including home devices.
It usually happens the other way in large companies. They take away access first thing in the morning then they send the Bobs in later to inform them that their services are no longer needed.
Blackmist@feddit.uk
on 12 Jun 2024 00:35
nextcollapse
That’s pretty god. Our fired employee just logged into the wifi from outside and changed the status on every helpdesk ticket to “Paul is a nob”.
In fairness to him, Paul was indeed a nob. And you don’t really want to do anything that might bring legal action against you, like I dunno, deleting a load of servers and losing your company close to a million. Just as a random example.
And the wifi password is now a long complicated string of characters that only gets given to a few people, rather than just being the company name with 123 at the end.
Landless2029@lemmy.world
on 12 Jun 2024 05:33
nextcollapse
Question. Where does this “value” come from? Loss of business? Downtime? Labor loss due to people unable to work? Pull a number out of a hat?
These servers had no production data on them. Ideally with a proper DR solution you just restore and presa charges.
CaptPretentious@lemmy.world
on 12 Jun 2024 11:45
nextcollapse
I would guess man hours.
Because it’s going to take time to put those servers back in production. Depending what they did it might have causing outage to external facing customers, which will have a higher impact than internal facing. But with that amount of money, it actually seems fairly low to me so I’m guessing they weren’t public facing servers.
So it was probably the time that it takes to recreate all those servers get everything back up and running, and delayed work caused by the outage.
That’s just my guess though
MystikIncarnate@lemmy.ca
on 12 Jun 2024 15:52
collapse
As an armchair economist, lots of things. Loss of money from workers standing around unable to do their jobs because of the technical issues, the cost of doing a restore from backup (technician time, extra help, direct costs of accessing the data), etc. Opportunity costs from having to send business away, or otherwise unreasonably delay taking/delivering orders that have either been given to competitors or cancelled because of the issues.
Even the dang electricity costs of keeping the lights on while waiting for a fix…
Large companies calculate this value as a “burn rate”, which is to say, how much is it directly or indirectly costing to have everyone here, ready to work, and unable to do so because of an issue that affects everyone. Usually measured in dollars per hour. So if their burn rate is 100k/hr, and it takes 10 hours to fix the problem, it’s ~$1M in losses.
They may be able to recoup some of those losses by adding an extra shift or granting overtime to catch up, but for the most part, a large percent of that money is simply gone.
thorbot@lemmy.world
on 12 Jun 2024 09:28
nextcollapse
Company deserved it if they didn’t have backups and didn’t change the admin passwords
Classic victim blaming. They were asking for it. They didn’t deserve a malicious actor.
grrgyle@slrpnk.net
on 12 Jun 2024 11:13
nextcollapse
Bet they’ll be going zero-trust next project increment though lol
Amelia_@lemmy.blahaj.zone
on 12 Jun 2024 12:06
collapse
victim blaming
Can’t tell if this is sarcasm, but corporations are not people, they are soulless, for-profit enterprises that will, for damn sure, abuse and exploit any one and any thing they can in the name of profit. They don’t get the defense of “victim blaming”.
If they open themselves up to malicious actors through improper security, or lawsuits due to improper practices, then that’s their own fault.
EatATaco@lemm.ee
on 12 Jun 2024 12:40
nextcollapse
Mom and pop grocery store - incorporated because they aren’t idiots - gets robbed. Not victims because they are a corporation?
Amelia_@lemmy.blahaj.zone
on 12 Jun 2024 12:47
collapse
It’s their own fault if they didn’t take the reasonable precautions that anyone should be aware of when going in to business for profit.
Notice how in my original comment I added “through improper security” and “improper practices”.
If you are running a business and get robbed without security cameras, insurance, and other reasonable protective and preventative methods, then you are at fault.
EatATaco@lemm.ee
on 12 Jun 2024 12:51
nextcollapse
You didn’t answer the question.
Amelia_@lemmy.blahaj.zone
on 12 Jun 2024 12:53
nextcollapse
It’s their own fault if they didn’t take the reasonable precautions that anyone should be aware of when going in to business for profit.
That’s cherry picking a single scenario which allows you to sort of maintain your position, but still doesn’t even answer the question in that particular case, and certainly does not answer the question as to whether that mom and pop shop can be a victim.
Rekorse@lemmy.dbzer0.com
on 13 Jun 2024 10:51
collapse
They replied elsewhere, that victim is a personifying trait and that applying it to inanimate objects makes no sense.
While corporations can be the victim of an attack in the technical sense, we wouldnt feel bad for the corporation because a corporation has no feelings that could be hurt, or any hopes that could be dashed, or whatever other reason someone might feel bad for a victim of something.
In the table example, the table is a victim of the spilled drink but that is a meaningless distinction because a table that is a victim is exactly the same as that same table when its not a victim.
You could say that the owner(s) of the business are the victims however, as they do have hopes and dreams and ambitions that are affected by these things. While you might still conclude the owners aren’t owed any sympathy, its for different reasons than a table would receive no sympathy.
todd_bonzalez@lemm.ee
on 12 Jun 2024 13:17
nextcollapse
You’re right, I wanted an answer to my question and instead you rephrased my question, which avoided my actual point, and then only kind of answered that question.
Let me try to rephrase to get to my point: this shop has security cameras, insurance, and other reasonable protective and preventative methods, they get robbed (which still result in a financial hit). Are they victims?
otp@sh.itjust.works
on 12 Jun 2024 13:40
nextcollapse
Another user to the pile here to say that their response fully answered your question.
It’s obvious who is confident in defending their position and who is not.
todd_bonzalez@lemm.ee
on 12 Jun 2024 14:03
collapse
you rephrased my question
No I didn’t.
this shop has security cameras, insurance, and other reasonable protective and preventative methods, they get robbed (which still result in a financial hit). Are they victims?
Yes, just like if a company properly offboards their employees, they would be victims if a disgruntled employee hacked them in retaliation.
But that’s not what happened. This “shop” doesn’t have locks on the doors. It’s hard to feel bad for them when they left the door wide open.
corporations are not people, they are soulless, for-profit enterprises that will, for damn sure, abuse and exploit any one and any thing they can in the name of profit. They don’t get the defense of “victim blaming”.
So you agree with me that corporations can be victims, which is what I was originally responding to and you originally challenged.
You’re now saying that if proper precautions are not taken, you can’t be considered a victim.
This is classic victim blaming, which is my point. If I leave my wallet on the table at a bar and someone steals it, despite me being an idiot I’m still the victim of a crime. It’s not my fault, it’s the fault of the person who stole it.
Just like with the company in the OP, they are idiots for not taking proper precautions against malicious actors, but it’s still the fault of the malicious actor.
Ehhh I dunno. Saying it’s the stores fault they got robbed feels wrong. It’s the robbers fault for, you know, robbing. I mean, how far does that go? They had locks but not good enough locks. Yeah they had locks but no security system. Well they had a security system but no guard. At some point the blame is on the person that actually committed the crime.
Amelia_@lemmy.blahaj.zone
on 12 Jun 2024 14:41
collapse
My point is that corporations cannot be victims because they’re not people, they’re a legal construct. They cannot be victims any more than a table can be a victim when I spill my drink over it. The term “victim”, whether intentional or not, is an emotive word that invokes ideas of injustice and suffering.
Marketing teams and corporate executives convinced people and legal systems that corporations are people in an attempt to engender sympathy, personification, and to avoid responsibility for their own failures, like the case in this article where managerial and procedural failures by those in charge led to the ability for this ex-employee to be able to do what he did.
Large corporations are irresponsible dicks, but when you commit a crime, you can’t waive tht away with “yeah but the victim was really bad!”
There is such a thing as both sides being wrong
FluffyPotato@lemm.ee
on 12 Jun 2024 18:55
collapse
Murder is wrong and all but I’m perfectly fine with someone shooting someone as bad as Hitler. Corporations do financial and environmental crime on a daily basis, someone causing financial loss for them provokes no sympathy from me.
FlyingSquid@lemmy.world
on 13 Jun 2024 11:19
collapse
I really don’t have a dog in this fight, but I do want to point out that we’re talking about an IT company (an apparently incompetent one) here, not some company that drills for oil in the Amazon.
threaded - newest
That might be slightly illegal.
That person might be slightly doomed.
Companies need to remember to change the login password BEFORE firing people with login passwords.
One man IT shop maybe? Usually stuff like that goes through IT, because who in their right mind would give HR modify access to active directory?
Read the article.
As a former user of “the other site”, I find this suggestion highly offensive /s
Generally a firing is decided the previous day or at least an hour before it happens. Discussions are made prior to the actual meeting where the firing occurs. IT is on standby. They either deactivate the AD account and related auth methods when the employee walks in the office to have the discussion. This is a well oiled machine, so that all parties know their parts. The meeting/discussion is solely a formality and by two minutes into it, theres no longer any access granted. Security shows up at the meeting to escort the employee out and collect their badge or keys. Maybe they let the employee walk by their desk to collect their stuff, maybe the employer ships it to them later, depends on the circumstances and office layout.
In well-run orgs, yes. Most places are not well-run.
I was let go somewhat recently and I noticed just yesterday that I still have admin access to their facebook app.
Time to get busy and say it’s a pen test of their systems.
At my last job I was informed that I’d be terminated, then had to work normally for another month (the termination period), where I still had full domain admin access to all our own and our customers’ systems.
On my last day I myself had to write down a list of all the logins I had and give that to my boss, because no one else knew what accesses I even had.
During the last hour I wiped my own company PC and gave back all hardware I was given. Again, there wasn’t any record of what I was given over the years so they took my word for it. This included unencrypted USB drives with sensitive medical data on them.
As someone who worked for German, as well as North American companies, your experience is not the norm in NA. Wish it was.
Last year, I tried my admin creds at my old job and it still worked. I was afraid of retaliation so I sent them a message from a throwaway email about changing their passwords.
Legally, it would have been better to send the mail from your personal account.
Otherwise there’s a possibility that something happens to get fucked up right around the time you logged in, they pull the logs and find your access.
Bam, motive and opportunity, and no way to provide an alibi.
I mean kind of depends. I got a soft layoff so worked 6 months more and got 3 months pay for the transfer to India.
I think best practices for highly secure environments is at the time of notice you lock the account and give that person 2 weeks off.
Most normal company’s it’s cool work till your last day, do your exit interview and we lock your account on Friday afternoon or Monday
Also you never want to change someone’s password on termination. What if their login is running some business critical tasks? Not best practices but I can tell you it happens a lot especially for reporting. If you lock the account you can always just reenable it and work to fix the issue
He didn’t hack anything. He used a password that wasn’t changed.
Which was also used repeatedly over the course of 3-4 months to gain access via a non-corporate laptop without the IT doing anything about it.
Yeah that seems pretty negligent on their part.
I’ve been in IT for a few years and I’ve changed companies a few times. I just checked my login creds for various systems of 3 previous employers and like half of them still work. Unfortunately it’s a lot more common than any IT department would like to admit
Technically he was not authorized to use the computer system due to his termination which the law looks at and calls hacking.
I’ll give you half a point because technically you are right.
No, the law specifically called this “unauthorized access to computer material”. It’s right there in the article.
I said the law looks at whether it was authorized access or not, I was not citing any literal lines from the law. Didn’t read the article because I know this already because of the industry I work in and I took a course a number of years ago that literally was about this.
It’s only hacking if it’s in a CVE.
Anything else is just sparkling unauthorized access.
But clickbait…
I hack my supermarket by stealing mangoes.
That’s just not true.
Social engineering isn’t hacking. It’s social engineering
Hacking humans, not technology
Social engineering = human hacking
He also didn’t delete servers
Wait…
Okay, what the guy did was immature and shitty, but holy hell this company is incompetent. How did their own internal IT not lock him out of anything even remotely sensitive the moment he was fired?
Probably HR (or the NCS equivalent) never told the right people. I am not saying this is actually what happened, but a lot of IT bemoan the fact they are never told some rando employee was fired because HR neglects to inform them. Sometimes it takes months to discover, and even with a 90 day password/login lockout, some halfway decent admin could get around this by secretly building a back door, and using the messed up communication and politics between departments to hide this. Even in the 1990s, I saw people put in “time bombs” in their code that “if such and such is not updated in 6 months, run destructo-script A.”
But imagine someone like Kandula Nagaraju here. Worked in QA, probably did a great jobs with some skills, but had the personality of swallowing broken glass. He was terminated in October 2022 due to “poor work performance,” which could mean anything. “Not a team player.” Or maybe he really was an idiot: I mean, a smart person would have a conniption, but get employed elsewhere and then slam his former company at parties. “Those NCS folks didn’t know what they had with me!” But this guy was probably someone with some anger management issues, probably a jerk, and possibly stupid. He might have had revenge fantasies, and set up a small virtual server posing as a backup code mirror. But outside the audits, it allowed ssh from the outside, and hid it through a knockd daemon. Or maybe only launched ssh at certain hours before shutting it down again. Silently working away in a sea of virtual servers with little to no updated documentation. He gets in, has internal access, and runs a script with admin credentials because they don’t rotate their AWS keys/secrets quickly enough. Or didn’t even know he was let go.
That’s embarrassing to the company. Not only did he get in, but SIX TIMES after he was let go. he probably knew what order to run the delete commands (like, say, an aws “terminate-instances” cli command from a primary node), and did so one by one, probably during hours with the least amount of supervision, where the first few alerts would take hours to get someone in the monitoring chain to wake an admin. Given his last day was in November, and he got back in January, the admins probably thought their 90 access credential rotation was “good enough,” but he got in on his 80th day or whatever.
I know this because I have had to do triage when a former contractor did this to a company I worked for. But instead of wiping out instances, he opened a new set of cloud accounts from the master account, put them in an unmonitored region (in this case, Asia), and spun up thousands of instances to run bitcoin mining. Only because AWS notified us of “unusual traffic” were we made aware at all, and this guy knew his shit and covered his tracks very well. He did it at a speed that could have only been automated. Thankfully, AWS did not charge us the seven figure amount that this activity amassed in just three days.
If its the NCS (National Computer Systems) that was bought by Pearson a few years ago, then what they sell is the hardware/software that reads all the “fill in the circle with a #2 lead pencil” forms.
I’m going to take a guess this is the guy that removed access from fired people under hr request, for $999.999
I’ve had people above me fired in a startup and I was asked by the board of the company to lock their accounts and seize their professional laptops while they were in a meeting informing them they were fired.
The idiots had tried to stage a “coup” against the CEO which failed spectacularly.
in my org it’s a single process to deprovision someone of access to all tools including home devices.
Makes sense, this was decades ago in a small startup. Nowadays HR systems are usually synched with the IAM.
It usually happens the other way in large companies. They take away access first thing in the morning then they send the Bobs in later to inform them that their services are no longer needed.
That’s pretty god. Our fired employee just logged into the wifi from outside and changed the status on every helpdesk ticket to “Paul is a nob”.
Couldn’t think of anything other than an insult a 7-year-old would come up with, huh?
In fairness to him, Paul was indeed a nob. And you don’t really want to do anything that might bring legal action against you, like I dunno, deleting a load of servers and losing your company close to a million. Just as a random example.
And the wifi password is now a long complicated string of characters that only gets given to a few people, rather than just being the company name with 123 at the end.
What the hell is a “nob”
that’s-a-penis.gif
Question. Where does this “value” come from? Loss of business? Downtime? Labor loss due to people unable to work? Pull a number out of a hat?
These servers had no production data on them. Ideally with a proper DR solution you just restore and presa charges.
I would guess man hours.
Because it’s going to take time to put those servers back in production. Depending what they did it might have causing outage to external facing customers, which will have a higher impact than internal facing. But with that amount of money, it actually seems fairly low to me so I’m guessing they weren’t public facing servers.
So it was probably the time that it takes to recreate all those servers get everything back up and running, and delayed work caused by the outage.
That’s just my guess though
As an armchair economist, lots of things. Loss of money from workers standing around unable to do their jobs because of the technical issues, the cost of doing a restore from backup (technician time, extra help, direct costs of accessing the data), etc. Opportunity costs from having to send business away, or otherwise unreasonably delay taking/delivering orders that have either been given to competitors or cancelled because of the issues.
Even the dang electricity costs of keeping the lights on while waiting for a fix…
Large companies calculate this value as a “burn rate”, which is to say, how much is it directly or indirectly costing to have everyone here, ready to work, and unable to do so because of an issue that affects everyone. Usually measured in dollars per hour. So if their burn rate is 100k/hr, and it takes 10 hours to fix the problem, it’s ~$1M in losses.
They may be able to recoup some of those losses by adding an extra shift or granting overtime to catch up, but for the most part, a large percent of that money is simply gone.
Company deserved it if they didn’t have backups and didn’t change the admin passwords
Classic victim blaming. They were asking for it. They didn’t deserve a malicious actor.
Bet they’ll be going zero-trust next project increment though lol
Can’t tell if this is sarcasm, but corporations are not people, they are soulless, for-profit enterprises that will, for damn sure, abuse and exploit any one and any thing they can in the name of profit. They don’t get the defense of “victim blaming”.
If they open themselves up to malicious actors through improper security, or lawsuits due to improper practices, then that’s their own fault.
Mom and pop grocery store - incorporated because they aren’t idiots - gets robbed. Not victims because they are a corporation?
It’s their own fault if they didn’t take the reasonable precautions that anyone should be aware of when going in to business for profit.
Notice how in my original comment I added “through improper security” and “improper practices”.
If you are running a business and get robbed without security cameras, insurance, and other reasonable protective and preventative methods, then you are at fault.
You didn’t answer the question.
Yes I did.
That’s cherry picking a single scenario which allows you to sort of maintain your position, but still doesn’t even answer the question in that particular case, and certainly does not answer the question as to whether that mom and pop shop can be a victim.
They replied elsewhere, that victim is a personifying trait and that applying it to inanimate objects makes no sense.
While corporations can be the victim of an attack in the technical sense, we wouldnt feel bad for the corporation because a corporation has no feelings that could be hurt, or any hopes that could be dashed, or whatever other reason someone might feel bad for a victim of something.
In the table example, the table is a victim of the spilled drink but that is a meaningless distinction because a table that is a victim is exactly the same as that same table when its not a victim.
You could say that the owner(s) of the business are the victims however, as they do have hopes and dreams and ambitions that are affected by these things. While you might still conclude the owners aren’t owed any sympathy, its for different reasons than a table would receive no sympathy.
No, you just didn’t get the answer you wanted.
You’re right, I wanted an answer to my question and instead you rephrased my question, which avoided my actual point, and then only kind of answered that question.
Let me try to rephrase to get to my point: this shop has security cameras, insurance, and other reasonable protective and preventative methods, they get robbed (which still result in a financial hit). Are they victims?
Another user to the pile here to say that their response fully answered your question.
I don’t see it. So please explain. Can they be a victim?
Sorry, you’re going to have to keep looking. Somehow, everyone else got the answer to your question.
It’s obvious who is confident in defending their position and who is not.
No I didn’t.
Yes, just like if a company properly offboards their employees, they would be victims if a disgruntled employee hacked them in retaliation.
But that’s not what happened. This “shop” doesn’t have locks on the doors. It’s hard to feel bad for them when they left the door wide open.
So you agree with me that corporations can be victims, which is what I was originally responding to and you originally challenged.
You’re now saying that if proper precautions are not taken, you can’t be considered a victim.
This is classic victim blaming, which is my point. If I leave my wallet on the table at a bar and someone steals it, despite me being an idiot I’m still the victim of a crime. It’s not my fault, it’s the fault of the person who stole it.
Just like with the company in the OP, they are idiots for not taking proper precautions against malicious actors, but it’s still the fault of the malicious actor.
That user that tagged you as “purposeful idiot” was fucking spot on.
Make up quotes, call me an idiot based on them not making any sense. Classic.
Wow, you’re doing it again. Amazing.
He did answer the question, you just didn’t understand his answer.
Pretty clear by the fact they keep asking for further clarification. Why’s everyone so afraid to try and engage further?
Ehhh I dunno. Saying it’s the stores fault they got robbed feels wrong. It’s the robbers fault for, you know, robbing. I mean, how far does that go? They had locks but not good enough locks. Yeah they had locks but no security system. Well they had a security system but no guard. At some point the blame is on the person that actually committed the crime.
My point is that corporations cannot be victims because they’re not people, they’re a legal construct. They cannot be victims any more than a table can be a victim when I spill my drink over it. The term “victim”, whether intentional or not, is an emotive word that invokes ideas of injustice and suffering.
Marketing teams and corporate executives convinced people and legal systems that corporations are people in an attempt to engender sympathy, personification, and to avoid responsibility for their own failures, like the case in this article where managerial and procedural failures by those in charge led to the ability for this ex-employee to be able to do what he did.
Yeah, and no.
Large corporations are irresponsible dicks, but when you commit a crime, you can’t waive tht away with “yeah but the victim was really bad!”
There is such a thing as both sides being wrong
Murder is wrong and all but I’m perfectly fine with someone shooting someone as bad as Hitler. Corporations do financial and environmental crime on a daily basis, someone causing financial loss for them provokes no sympathy from me.
I really don’t have a dog in this fight, but I do want to point out that we’re talking about an IT company (an apparently incompetent one) here, not some company that drills for oil in the Amazon.
They will think twice before fire someone else. Well done
Server IP address: 192.168.1.1
Username: admin
Password: 12345
— Access Granted —
sudo rm -rf / --no-preserve-root
<img alt="" src="https://lemmy.world/pictrs/image/e53efbcd-5b01-455e-96d5-796278da6b19.gif">