How should I behave when I deleted data that shouldn't have been on my computer?

Question

Today I received the company PC of a developer who had left the company.

I came to realize that this PC had been poorly "cleaned" and some of his work remained there. I had no problem with that, mainly little settings and so on, so I decided to go on with my work.

I started working on my new project, and found out that he left a big database of his previous project, which contains some highly sensitive data about people working in the office. I immediately deleted everything from the PC, since I knew I shouldn't have access.

Now my boss came to me and asked to give back the PC in the evening because the previous developer informed him that he left the database on the PC. The boss wants to take the PC so he can make a copy of the data for himself.

Now I don't know what to say to my boss, because I probably deleted something of huge importance without his approval and I don't know if the fault is mine or someone else.

I'm pretty sure I did the right move, but how can I overcome this situation? How should I respond if he blames me for deleting it when he shouldn't have given me the PC without removing the data in the first place?

Unfortunately I wasn't able to confess this to the boss as soon as he asked me for the PC back, because he entered my office, told me that and immediately ran out due to a conference, so I have the time to "make my move".

_{Update: I told the truth to my boss, that I assumed I did not have permission to view that file and thus deleted it to protect sensible data of my colleagues and he agreed that HE made the bad move to not checking the work of the last dev before he gone. Now he wants to retrieve data and to create a new policy for treating data remotely and no more locally, no matter how much money they will spend}

Answer 1

Honesty is the only policy here. "I saw this file and realized it was something I should not have access to and deleted it". There is very little that you can do to insulate yourself from it at this point unfortunately.

Good luck.

Answer 2

Answer honestly. If what you did was within the scope of what you're actually supposed to do with improperly cleaned machines, you should be fine.

The way to respond is to cite your duties. Hopefully that will insulate you but the simple reality is that if your company wants a scapegoat, they will often find one.

Answer 3

In hindsight you should have asked your boss or IT what to do about the data. There was no urgent need to delete that data just don't look at it. That was the only copy or latest copy was a real possibility.

When your boss asked for the PC you should have immediately told your boss that you had already deleted files.

You should not delete any more files and consider turning it over to IT immediately so they may have a chance to recover the files.

Answer 4

because I probably deleted something of huge importance without his approval and I don't know if the fault is mine or someone else

In complex systems there is no single person at fault. Humans don't often deal well with that reality, and like to have someone to blame.

In an ideal world

• The company would not have had important information stored on one local computer as a single point of failure
  • without a backup.
• The developer would have tidied important things up before leaving.
• The computer would have been wiped / re-imaged before your use of it.
• No employee would have access permissions to delete important things.
• Deleting important things would come through a change request process with signoff from multiple people.
• Management would have checked important things the developer worked on are all how they should be, before the developer left.
• The company would have some kind of disaster-recovery plan for what to do if important information is lost.

All of those things are process failures in some way or another, and not any one individual's fault. Blame may float around - developer, for building something locally with no backup; management for not picking up on that and enforcing centralised work and backups; upper-level management for not having quality procedures in place to circle round and flag that up and fix it; and back to you for deleting it; because there is no single place to put the blame. Everyone will try to shoo it away and defend themselves. Sadly, you were the point of action and everyone else has the universal-winning-card "you shouldn't have done what you did, * ~ it's just common sense ~ *" and nod to each other and that's that.

In an ideal world again, nobody would be trying to find fault, and everyone would focus on how to get the database and what to do in future to avoid that happening.

You haven't said what kind of database (single file, uninstalled database engine, etc).

• You can try honesty "I deleted it because I thought I shouldn't have access to it, and didn't want anyone to think I had copied it to steal company information"
• Try getting the data back if possible, easily (recycle bin, Previous Versions)
• Check if the database was in some kind of source / revision controlled folder, it might be possible to roll that back to a previous version (don't do that).
• Check if the database was in some kind of version control that the developer might still have a copy on a laptop / at home (although they would be wary of admitting it).
• Search the computer for files of similar names ("Copy of thing", "thing (1)", "thing - new") which might be recent clones of it.
• Call / email the developer, if they will talk to you, ask if they have a copy anywhere else - if they might answer and do you a favor.
• Stop using the computer so you don't risk overwriting anything.

When your boss comes out of the meeting, have an honest admission, an apology (regardless of if you feel at fault or not), a list of things you've checked, and ways the company could go forward - undelete tools, dev might know of an older copy elsewhere, what you saw in the database that might need rebuilding (maybe), anything else you can think of.

If your boss wants to blame you, there isn't much you can do, but if you can stop it from being a problem for your boss, that might stop it being a problem for you.

Answer 5

As others have said: honesty is the best option in this situation, you don't want to have it seem like you're covering something up or hiding something. Just explain what you did (and why) and then ask how you should have handled the situation differently in the future.

The other reason I'm adding this answer is this: when there is a situation in a work environment where you have something (or have access to something) that you aren't supposed to... NEVER delete, alter or otherwise touch anything.

The very first thing you need to do is contact your supervisor and/or security manager and inform them that you have "spillage" and that they need to investigate/resolve the situation. It is extremely important that you take no action so that they have the ability to assess the situation as you found it.

Your mistake here wasn't your intention, it was the fact that you acted without instruction in a potential security breach. Information security is one of the single most important areas these days, and while I'm not trying to make you nervous you should understand that companies take that stuff extremely seriously.

Answer 6

To play the devils advocate: Honesty is not the only option. Depending on the culture, you could be used as a scapegoat if something would fail. You can lie that you have "cleared" the computer completely. Removing everything automatically can be thought as a normal thing to do and you had no knowledge that there was a database. This way you did not do a wrong decision, but you were not aware that the computer had information it should not have had. It is harder to point out your accountability for the mistake, if you did not do a decision.

Rest of the answers give already what you could/should do: Give the PC to IT for recovery.