-
Turning over company files stored on personal laptop?
Posted by
Pack34
on 16 Jul, 2018 05:34
-
Out of necessity, I've had to use my personal laptop for a couple years. It has all of my personal and financial information on it as well as some design files for a couple companies I've moonlighted for over the past couple years.
I'm meticulous in documenting my designs and making sure everything is uploaded, committed, etc. Everything is there with the likely exception of some raw and random test data I can dump on an external drive.
Considering that it's my personal property, has confidential information on it, etc. I do not feel comfortable handing it over for them to ensure it's scrubbed. I was planning on making sure that everything was uninstalled, deleted, and the recycle-bin is purged. Then walk someone from IT through it to demonstrate that their information isn't on my computer anymore.
I've used almost exclusively my own software, computer, and test equipment while here. I've always been given the "cash flow" excuse when asking for equipment so I gave up asking. Hence why I'm in this situation now.
-
#1 Reply
Posted by
rdl
on 16 Jul, 2018 05:46
-
Why would you even consider handing your personal computer (with your personal info on it) to somebody else so they can "examine" it? What good would it do them anyway? You could have multiple copies elsewhere. Actually, I hope you do have multiple copies elsewhere. Backups of important data is a good thing to have.
-
#2 Reply
Posted by
Berni
on 16 Jul, 2018 06:35
-
That makes no sense to me.
How does this prove you whipped the data when you could have copied it to an USB drive and left it at home. Do they also have to do a search of your home and check any data storage medium they find. What about your Dropbox account, you could have kept the files there so you have to give then your Dropbox login too...
You can proabobly sign some form of NDA like document on that data instead.
-
#3 Reply
Posted by
Halcyon
on 16 Jul, 2018 06:59
-
Erase it yourself using a tool which will certify that the drive bearing serial number XYZ has been erased to a particular standard.
Active@ Killdisk for example. Then allow them to confirm that the drive erased is the one installed in your laptop. Or, perform a secure erase first yourself, then hand it to them in a santised state.
I would not be handing over any of your personal equipment with data intact unless compelled to by a court.
Sure it means that you will have to re-install everything (I suppose you could take an image of it before-hand).
-
-
I'd probably end up just backing up what's not theirs and wipe the drive, likely less hassle. Get comp for time though, if you can. Definitely not signing NDA willy nilly though
-
#5 Reply
Posted by
firewalker
on 16 Jul, 2018 07:10
-
Backup your stuff (everything
). Tell them to buy you an SSD (better one) for you laptop. Destroy the old disk in front of them. Ask a signed confirmation that they acknowledge the data destruction and you are free of any blah blah.
Alexander.
-
#6 Reply
Posted by
Pack34
on 16 Jul, 2018 07:11
-
The setup is a bit wonky and I'm trying to think of the cleanest way to depart. I was overly nice last time I changed jobs with training and turnovers and I paid for it. I helped train them for three months afterwards so they would be sustained until they landed a replacement. That ended up a mess. I ended up being shorted pay and they felt they deserved more work out of me.
When the offer letter is officially signed, it'll be a 50% raise and I want this done clean, fast, and both parties as happy as possible. I want to be doing my next thing and make sure my reference at this place is as positive as possible.
-
#7 Reply
Posted by
Halcyon
on 16 Jul, 2018 07:15
-
When the offer letter is officially signed, it'll be a 50% raise and I want this done clean, fast, and both parties as happy as possible. I want to be doing my next thing and make sure my reference at this place is as positive as possible.
Then your only real solution is to satisfy them but do it in a way that is fair and reasonable to you too. Ask if you can supervise the secure erase procedure yourself, so you know that no one is messing around with your private data. If it were me, I would securely erase that drive first, then hand it over to them to repeat the process to their satisfaction, if all they are worried about is making sure that disk is erased, then they have no reason to start poking around.
-
#8 Reply
Posted by
Mr. Scram
on 16 Jul, 2018 07:18
-
I personally have the rule that if a company wants to manage it, they have to spring for it. In this case it seems the company didn't want to do this despite repeated requests, so they don't have a say in the matter. If they provide you with a laptop, it's a different story. Their hardware, their rules. Your hardware, your rules. Due to the presence of your own information your interest is at least as big as yours, though I would say your risk is bigger. Their risk is a professional one, while yours is personal.
If they regret their stance in hindsight, they might ask you to clean the disk in company time. Have them spring for a replacement disk and after copying your stuff to that you shred the current disk. They should be happy you worked with hardware you paid yourself, not cause your problems because of it. They dropped the ball here. Maybe they'll learn something. Though I doubt it, as the also had you use your own personal lab equipment. One can't really feel sorry for an organisation that exploits its employees like that.
-
-
Ask if you can supervise the secure erase procedure yourself, so you know that no one is messing around with your private data. If it were me, I would securely erase that drive first, then hand it over to them to repeat the process to their satisfaction, if all they are worried about is making sure that disk is erased, then they have no reason to start poking around.
Sanitizing the disk before they get to inspect is the way to go, since he has confidential files on the computer from other parties (and his own).
-
#10 Reply
Posted by
tszaboo
on 16 Jul, 2018 07:34
-
I bring 3 types of items to my workplace, which I leave there:
Pens (Staedtler pigment liner, office always cheap out on technical pens) and ruler, food, headphone (because office always thinks that sharing headsets are hygienic). That's it. I very rarely take a tool home from the office, after asking, returning next day.
And then there are some people, who think their home office is just some kind of extension to the office, sharing expensive test equipment, products and IT infrastructure at will. BYOD is just crazy IMHO.
-
#11 Reply
Posted by
AndyC_772
on 16 Jul, 2018 07:42
-
Anyone *that* keen on verifying that your personal laptop is 'clean', doesn't understand the concept that digital files can be copied.
Your laptop being totally sterile means nothing. If you wanted to surruptitiously keep hold of company material, you'd simply copy it to another drive. You know that, they know that, anyone who has ever used a computer knows that. Giving a company IT tech access to your laptop is pure theatrics.
Comply with any obligations you already have to delete company data. Flat-out refuse to sign anything new. If you're leaving a company, you have nothing to gain by agreeing to any new obligations as part of an exit process - so don't.
-
#12 Reply
Posted by
Pack34
on 16 Jul, 2018 07:48
-
I bring 3 types of items to my workplace, which I leave there:
Pens (Staedtler pigment liner, office always cheap out on technical pens) and ruler, food, headphone (because office always thinks that sharing headsets are hygienic). That's it. I very rarely take a tool home from the office, after asking, returning next day.
And then there are some people, who think their home office is just some kind of extension to the office, sharing expensive test equipment, products and IT infrastructure at will. BYOD is just crazy IMHO.
This next job will be the first one I'll work at that isn't BYOD (laptop excluded). They've all been to either use the <100MHz monochrome scopes and $20 irons provided or bring your own from home. I've never had an equipment purchase approved.
-
#13 Reply
Posted by
Mr. Scram
on 16 Jul, 2018 07:52
-
Sanitizing the disk before they get to inspect is the way to go, since he has confidential files on the computer from other parties (and his own).
It's quite hard and a lot of work to completely sanitize a disk and you're never quite sure whether you caught everything, especially when it's an OS disk. OSs tend to spread data everywhere. It doesn't help that these people have completely different interests than you do. You can't assume your data is safe in their hands, even if they mean well. Like I said before, Pack34's interest is at least as big as the companies. He has personal data on that disk. His own privately owned disk.
It's assumed they worry about third parties accessing the information left on your disk. As AndyC_772 remarks correctly, they can't exactly stop you from copying it elsewhere anyway. Copying your personal data to another disk and shredding the original disk completely is quite a bit safer than sanitizing a disk. It protects the company both from the disk being stolen and your computer being infected by malware that steals data. Although again, the fact that they have relevant data on your computer is a problem of their own making. They're to suggest how to solve their own problem.
-
#14 Reply
Posted by
Mr. Scram
on 16 Jul, 2018 07:54
-
This next job will be the first one I'll work at that isn't BYOD (laptop excluded). They've all been to either use the <100MHz monochrome scopes and $20 irons provided or bring your own from home. I've never had an equipment purchase approved.
BYOD typically means providing a budget with which a device can be bought. Dumping it on the employee is a cheapskate tactic I rarely see.
-
#15 Reply
Posted by
Pack34
on 16 Jul, 2018 08:04
-
This next job will be the first one I'll work at that isn't BYOD (laptop excluded). They've all been to either use the <100MHz monochrome scopes and $20 irons provided or bring your own from home. I've never had an equipment purchase approved.
BYOD typically means providing a budget with which a device can be bought. Dumping it on the employee is a cheapskate tactic I rarely see.
It might just be a combination of size and product type of the companies. Mom-and-pop sized places combined with the EE portion being seen as the technology that facilitates the sale rather than being seen as a core part of the product. From my experience it seems common.
-
#16 Reply
Posted by
Ian.M
on 16 Jul, 2018 08:16
-
At home, drive to drive image backup the drive, and scrub their files on the image with a file level secure erase tool. After verifying that all your and 3rd party files are intact on the backup, scrub all your (and 3rd party) confidential files on the laptop. Uninstall the backup software and the file level secure erase tool (or better yet run them from live CD in the first place). Make sure the machine boots without errors, and common applications launch correctly.
If you are feeling mean 'salt' it with OSHW designs, FOSS software sources and cat pictures etc. with randomised filenames.
Remove *all* clutter from your laptop bag, only leaving the machine, its PSU and power lead.
In the interests of good will and a swift departure, offer supervised access to the machine in your presence during paid working hours, for them to remove any data they believe belongs to them, on the basis that you will not permit an image copy to be made or for them to retain the physical drive (though if they are willing to pay the full cost of its replacement you will permit its physical destruction in your presence), and that you will demonstrate that the machine boots and runs correctly before they touch it and if it does not boot and run the same afterwards, they are responsible for all costs for a 3rd party repair service to restore it to the operating condition it was in before they touched it + for hire of an equivalent replacement machine while it is being repaired.
-
-
You've not said what they have actually asked for ( if anything)
Just tell them you've removed their data and that's the end of it, and ignore any further requests. If they don't trust you, what are they doing hiring you
As soon as they made it necessary for you to use your own laptop, they lost any right to inspect it.
-
#18 Reply
Posted by
Mr. Scram
on 16 Jul, 2018 08:23
-
It might just be a combination of size and product type of the companies. Mom-and-pop sized places combined with the EE portion being seen as the technology that facilitates the sale rather than being seen as a core part of the product. From my experience it seems common.
I think it largely depends on where you work geographically. US labour laws tend to be quite a bit more liberal than those in many countries of the EU. The latter can differ quite a bit between countries.
-
#19 Reply
Posted by
Pack34
on 16 Jul, 2018 08:23
-
You've not said what they have actually asked for ( if anything)
Just tell them you've removed their data and that's the end of it, and ignore any further requests. If they don't trust you, what are they doing hiring you
As soon as they made it necessary for you to use your own laptop, they lost any right to inspect it.
Nothing has been requested yet. Getting my "ducks in a row" before resigning.
-
#20 Reply
Posted by
Mr. Scram
on 16 Jul, 2018 08:30
-
Nothing has been requested yet. Getting my "ducks in a row" before resigning.
You're overthinking a problem that doesn't exist. And whatever you do, don't make it a problem that does exist.
-
#21 Reply
Posted by
Halcyon
on 16 Jul, 2018 10:29
-
Sanitizing the disk before they get to inspect is the way to go, since he has confidential files on the computer from other parties (and his own).
It's quite hard and a lot of work to completely sanitize a disk and you're never quite sure whether you caught everything, especially when it's an OS disk. OSs tend to spread data everywhere.
Not at all. Download
DBAN, throw it on a USB or CD, boot it up and let it do its thing. Even a single pass is more than enough in 99% of cases. Don't get too hung up on multiple passes or specific standards, one is enough.
Of course (if you didn't already know) running DBAN will ensure everything on the disk is irrecoverably gone. Operating system, any recovery partitions, user data, the lot. The only things it won't touch are the Host Protected Area and any remapped sectors on an SSD, but don't worry too much about those.
-
#22 Reply
Posted by
bd139
on 16 Jul, 2018 10:33
-
The last contract I did wanted me to do this. So I informed them that it was outside of the contract and therefore chargeable and the charge was £2500 for data removal and reconstruction as it was my kit and would cost me time, money and software.
They didn't take that optional service
-
#23 Reply
Posted by
Mr. Scram
on 16 Jul, 2018 10:58
-
Not at all. Download DBAN, throw it on a USB or CD, boot it up and let it do its thing. Even a single pass is more than enough in 99% of cases. Don't get too hung up on multiple passes or specific standards, one is enough.
Of course (if you didn't already know) running DBAN will ensure everything on the disk is irrecoverably gone. Operating system, any recovery partitions, user data, the lot. The only things it won't touch are the Host Protected Area and any remapped sectors on an SSD, but don't worry too much about those.
You're talking about shredding the disk, not sanitizing it. I've explained in one of my earlier posts that shredding it is the better option, after evacuating the personal data to another disk. It's still a hassle to sort through your files and risk shredding something you intended to keep. I wouldn't go through all that effort without a very good reason. Sanitizing an OS disk, meaning that you keep the OS and some files and permanently destroy others, is very hard and tedious to do properly. Most OSs shift data around all the time and it's not always accessible or obvious to the user.
One thing that does worry me is that OP seems to suggest this is the only copy of his data. Obviously, proper backups need to be made if the data is worth anything.
-
#24 Reply
Posted by
Mr. Scram
on 16 Jul, 2018 10:59
-
The last contract I did wanted me to do this. So I informed them that it was outside of the contract and therefore chargeable and the charge was £2500 for data removal and reconstruction as it was my kit and would cost me time, money and software.
They didn't take that optional service
It's also a case of being fairly easy to do if requested beforehand, but painful and tedious when requested after the fact.