161

Today I received the company PC of a developer who had left the company.

I came to realize that this PC had been poorly "cleaned" and some of his work remained there. I had no problem with that, mainly little settings and so on, so I decided to go on with my work.

I started working on my new project, and found out that he left a big database of his previous project, which contains some highly sensitive data about people working in the office. I immediately deleted everything from the PC, since I knew I shouldn't have access.

Now my boss came to me and asked to give back the PC in the evening because the previous developer informed him that he left the database on the PC. The boss wants to take the PC so he can make a copy of the data for himself.

Now I don't know what to say to my boss, because I probably deleted something of huge importance without his approval and I don't know if the fault is mine or someone else.

I'm pretty sure I did the right move, but how can I overcome this situation? How should I respond if he blames me for deleting it when he shouldn't have given me the PC without removing the data in the first place?

Unfortunately I wasn't able to confess this to the boss as soon as he asked me for the PC back, because he entered my office, told me that and immediately ran out due to a conference, so I have the time to "make my move".

Update: I told the truth to my boss, that I assumed I did not have permission to view that file and thus deleted it to protect sensible data of my colleagues and he agreed that HE made the bad move to not checking the work of the last dev before he gone. Now he wants to retrieve data and to create a new policy for treating data remotely and no more locally, no matter how much money they will spend

  • Comments are not for extended discussion; this conversation has been moved to chat. – Jane S Feb 24 '17 at 1:38
  • 136
    @Anon Thanks for the update, we rarely see the outcome of questions here. Glad to see that your boss appreciated the situation and made the right call. – Snow Feb 24 '17 at 9:27
  • 3
    Note that recovery should be possible if you didn't "wipe" the database (i.e overwrite it with nonsensical data). – dorukayhan Feb 26 '17 at 18:34
254

Honesty is the only policy here. "I saw this file and realized it was something I should not have access to and deleted it". There is very little that you can do to insulate yourself from it at this point unfortunately.

Good luck.

  • Comments are not for extended discussion; this conversation has been moved to chat. – Jane S Feb 24 '17 at 1:40
  • 48
    In addition to this being the honorable move it's also going to save your boss because now he knows why he can't find the database and can start data recovery before the DB is over written permanently with some new file. – candied_orange Feb 24 '17 at 3:54
  • 10
    Just be honest. Detail all your actions and don't make any decisions. That's your boss's responsibility. – phillipsk Feb 24 '17 at 4:43
  • I don't understand this if you don't have access to the DB then why is it necessary to delete it? Shouldn't just informing the boss that you have this file and asking what should you do with it right thing to do? – Prison Mike Feb 27 '17 at 12:25
  • @newguy the point is that i should NOT HAVE access to that DB, still i had – Anon Feb 27 '17 at 16:50
90

Answer honestly. If what you did was within the scope of what you're actually supposed to do with improperly cleaned machines, you should be fine.

The way to respond is to cite your duties. Hopefully that will insulate you but the simple reality is that if your company wants a scapegoat, they will often find one.

  • 96
    I'd also stop working on the PC and hand it in to the IT department. It's possible that the files can be undeleted. – Snow Feb 23 '17 at 15:03
  • 3
    we don't have a "manual of the perfect machine cleaner" or so on, i think i did the better choiche, cause the data would'nt AT ALL had been on my hands, my fear is exactly the one you told...being the scapegoat of the negligence of my boss – Anon Feb 23 '17 at 15:04
60

In hindsight you should have asked your boss or IT what to do about the data. There was no urgent need to delete that data just don't look at it. That was the only copy or latest copy was a real possibility.

When your boss asked for the PC you should have immediately told your boss that you had already deleted files.

You should not delete any more files and consider turning it over to IT immediately so they may have a chance to recover the files.

23

because I probably deleted something of huge importance without his approval and I don't know if the fault is mine or someone else

In complex systems there is no single person at fault. Humans don't often deal well with that reality, and like to have someone to blame.

In an ideal world

  • The company would not have had important information stored on one local computer as a single point of failure
    • without a backup.
  • The developer would have tidied important things up before leaving.
  • The computer would have been wiped / re-imaged before your use of it.
  • No employee would have access permissions to delete important things.
  • Deleting important things would come through a change request process with signoff from multiple people.
  • Management would have checked important things the developer worked on are all how they should be, before the developer left.
  • The company would have some kind of disaster-recovery plan for what to do if important information is lost.

All of those things are process failures in some way or another, and not any one individual's fault. Blame may float around - developer, for building something locally with no backup; management for not picking up on that and enforcing centralised work and backups; upper-level management for not having quality procedures in place to circle round and flag that up and fix it; and back to you for deleting it; because there is no single place to put the blame. Everyone will try to shoo it away and defend themselves. Sadly, you were the point of action and everyone else has the universal-winning-card "you shouldn't have done what you did, * ~ it's just common sense ~ *" and nod to each other and that's that.

In an ideal world again, nobody would be trying to find fault, and everyone would focus on how to get the database and what to do in future to avoid that happening.

You haven't said what kind of database (single file, uninstalled database engine, etc).

  • You can try honesty "I deleted it because I thought I shouldn't have access to it, and didn't want anyone to think I had copied it to steal company information"
  • Try getting the data back if possible, easily (recycle bin, Previous Versions)
  • Check if the database was in some kind of source / revision controlled folder, it might be possible to roll that back to a previous version (don't do that).
  • Check if the database was in some kind of version control that the developer might still have a copy on a laptop / at home (although they would be wary of admitting it).
  • Search the computer for files of similar names ("Copy of thing", "thing (1)", "thing - new") which might be recent clones of it.
  • Call / email the developer, if they will talk to you, ask if they have a copy anywhere else - if they might answer and do you a favor.
  • Stop using the computer so you don't risk overwriting anything.

When your boss comes out of the meeting, have an honest admission, an apology (regardless of if you feel at fault or not), a list of things you've checked, and ways the company could go forward - undelete tools, dev might know of an older copy elsewhere, what you saw in the database that might need rebuilding (maybe), anything else you can think of.

If your boss wants to blame you, there isn't much you can do, but if you can stop it from being a problem for your boss, that might stop it being a problem for you.

  • 3
    Better to phrase it as protecting the data rather than protecting yourself against allegations of misbehavior: "I recognized that this file contained privileged information, and because having sensitive data on an insecure PC is a violation of data protection policy, the sensitive data is no longer on this machine." – Ben Voigt Feb 23 '17 at 22:52
  • 1
    At first glance I didn't think all the "ideal world" stuff very relevant, but after some thought I think those will be pretty good as a last ditch defence for somebody in this situation. +1. – user30031 Feb 24 '17 at 1:11
  • 1
    @DoritoStyle I think the value behind the "ideal world" section is it demonstrates how many really bad mistakes must have been made by people other than the asker for this situation to have arisen. Management should have signed off on a policy regarding data storage and retention. IT should have enforced and executed that policy to the greatest extent possible. HR should have participated by making sure that the policy was executed when the previous employer departed. Everyone should have communicated the policy so the asker knew what to do when they found the data, etc., etc. – Todd Wilcox Feb 24 '17 at 21:57
4

As others have said: honesty is the best option in this situation, you don't want to have it seem like you're covering something up or hiding something. Just explain what you did (and why) and then ask how you should have handled the situation differently in the future.

The other reason I'm adding this answer is this: when there is a situation in a work environment where you have something (or have access to something) that you aren't supposed to... NEVER delete, alter or otherwise touch anything.

The very first thing you need to do is contact your supervisor and/or security manager and inform them that you have "spillage" and that they need to investigate/resolve the situation. It is extremely important that you take no action so that they have the ability to assess the situation as you found it.

Your mistake here wasn't your intention, it was the fact that you acted without instruction in a potential security breach. Information security is one of the single most important areas these days, and while I'm not trying to make you nervous you should understand that companies take that stuff extremely seriously.

  • 1
    Important answer — one has to recognize that there were more options than "look at the sensitive data" or "delete the sensitive data". – NReilingh Feb 26 '17 at 4:40
-1

To play the devils advocate: Honesty is not the only option. Depending on the culture, you could be used as a scapegoat if something would fail. You can lie that you have "cleared" the computer completely. Removing everything automatically can be thought as a normal thing to do and you had no knowledge that there was a database. This way you did not do a wrong decision, but you were not aware that the computer had information it should not have had. It is harder to point out your accountability for the mistake, if you did not do a decision.

Rest of the answers give already what you could/should do: Give the PC to IT for recovery.

  • 2
    While I realize that some people/companies look for scapegoats to cover themselves, lying about a situation will, most likely, come back to bite you eventually. Even if the OP gets fired for it, he can discuss the situation with a clear conscience at future interviews. "Why did you leave your former employer?" "I was fired for deleting sensitive data I shouldn't have had access to. I realize now that I acted in haste and should have cleared it with manager/IT/security first and I've learned from that." If the future employer doesn't like the honest answer, it may not be the best place to work. – FreeMan Feb 24 '17 at 21:44
  • @FreeMan the OP is asking a way to "make my move". This is an alternative option, which while not honest, lessens the accountability on the action. It cannot bite back, because there is no evidence or no cover-up actions. – user3644640 Feb 26 '17 at 17:43
  • And to be realistic: We live in a sad Machiavellian world. If OP would be only a junior without networks, and the database would not have a duplicate thus rising the damages high, it could be that he never gets that chance to future interviews. The future employers might ask from the previous company before interview and get their version of the story that fired the OP. While the company the OP is in would be a terrible place to work, it would still be the best to leave the company for better opportunities later with good looking CV, than being sacked from the first job in a few months. – user3644640 Feb 27 '17 at 11:22
  • Depends on where in the world you are. In the US, your previous employer will only verify that you were employed for the dates you stated. Many even prevent management & rank-and-file from being used as references for future job searches. I do agree, though, that sometimes the "little white lie" does seem the easiest way out, sadly, but my personal opinion is that it shouldn't be encouraged. – FreeMan Feb 27 '17 at 13:20
  • It would be ideal if mistakes would teach rather than covered up. For example clients seldom are alerted about possible late deliver, before it must be told. The mistakes of scheduling are tried to cover-up by burn-outing the teams. I think that it is much more embarrassing to tell a week before scheduled delivery that the delivery will be months late, than often alert early. It is in a sense Machiavellian, that we all know how things should be, but that is not how it is. Still we buy the software from the company with few really bad screw ups rather than the unreliable one that always alerts. – user3644640 Feb 27 '17 at 14:05

protected by Community Feb 24 '17 at 9:41

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.