update: telling my company to revoke my IT access during our legal dispute

by Alison Green on July 21, 2017

Remember the letter-writer last month who was on unpaid leave during a legal dispute with her company, had discovered that they hadn’t revoked her high-level IT access, and was wondering how to suggest they do so? (#5 at the link) Here’s the update.

I’m the letter-writer who asked about how to tell a company I was embroiled in a legal dispute with that I still had high-level IT admin permissions that had never been removed. A few folks in the comments asked for an update, and I am happy to have one.

A quick clarification first–nearly everyone told me all this communication should be coming from my lawyer and not me, and seemed shocked I was still talking to my company directly. I think this is a cultural difference between the U.S. and here–the process here is designed to minimise the need for litigation and NOT involve lawyers directly until very late. There’s about 4-6 rounds to the full process (as opposed to the U.S., where it seems like there’s nothing between “hope they come to their senses” and “take them to court”), and lawyers don’t really get involved directly until about round 5 (actually appearing in court). Earlier than that you’re allowed to have “legal advice” but are supposed to self-represent and have to petition the court to have a lawyer officially represent you in the earlier stages. While my company knew I was seeking legal advice, the communication stayed through me (advised by her) and my lawyer repeatedly advised me to minimize references to her, getting legal advice, “my lawyer says,” “I’ve been advised by a lawyer that,” etc. because she says that usually escalates things too quickly and makes it less likely to get a satisfactory outcome at the earlier stages. This sounds unlike what I’ve read on here about the U.S., where it seems this is often used as a soft threat to get people to back down before going to court.

A couple of things happened shortly after my question was answered. First, the HR person who had been so hostile ramped up their behaviour again and tried to have me flat out fired on a trumped up charge. I immediately escalated to the next step in the legal proceedings (essentially from the “flag that it’s happening but try to work it out yourselves” stage to the “telling the court we don’t think we can work it out and requesting official mediation” stage, which is mandatory before a hearing) and then I demanded to work with a different HR person.

This solidified for me that I needed to handle this access issue ASAP to reduce my personal risk. But based on the commentariat here, I knew I needed to approach it really carefully. I was pretty taken aback by the number of people who were of the opinion that I had done something wrong or that my company was going to think I had done something wrong by even knowing I still had access to the system (from passive alerts, as I clarified in the comments) or by thinking about the fact that I did. Junior Dev really hit the nail on the head with their comment: “It’s part of my job to make computer systems more secure; that means I have to understand the ways they could be insecure. But to people who don’t deal with those issues on a daily basis, all this can sound like scary hacker talk, or at least be hard to understand why someone could have good intentions yet still see opportunities to do harm.” I was thinking like an IT person trying to make security better talking to people who don’t understand IT security and I needed to moderate my message to accommodate for that.

I decided the best way to handle this was in the context of playing the “being the bigger person” card, even though part of me still just wants to tell them where to stuff it. I wrote the new HR person and told them with their permission I was planning to send my boss a short document to ease the difficulty of my unexpected absence on the company, which they said would be very appreciated. Then I spent about 30 minutes brain-dumping a document outlining things I had admin access to that needed to be transferred to other people, including things I knew had been missed because they hadn’t transferred my permissions yet (e.g., some of those passive notifications I mentioned, like error messages about integration between these systems).

This gave me the chance to both flag I needed to be removed from these systems and a chance to say politely “your info sec is crap; you should probably fix that for the future” (but worded much more professionally with a line taken nearly verbatim from from of the commenters about probably needing to update policies for the future to accommodate people being on unexpected absences for security and functional reasons), but all under the guise of helping them out. It was my assumption (cleared with my lawyer!) that this document would likely cut off any trouble before it started, but also protect me in case the worst I feared did happen.

I’ve always tried to deal with my company in good faith even when they weren’t returning the effort, and in this case it paid off. Between the new HR person and the goodwill over this document, they changed the tone of our interactions entirely and we went into the conciliation process with them being actually, well, conciliatory. We were able to negotiate a mostly-amicable settlement deal and I agreed to transition out in exchange for a reasonable severance. This let us avoid going to court entirely.

I wish none of this had happened and I was still working there, but it’s the best outcome for a crap situation, and now I am going to take a bit of a break then figure out how to move forward. A giant thanks to everyone here for helping me sort out my head about this during a very, very stressful time. It was extremely, extremely useful to have all of your perspectives.

You may also like:
{ 62 comments }

{ 62 comments… read them below }

  2. Hrovitnir*

    What a great update! Probably the best you could expect with that start. Thanks for the update: it was really interesting.

    1. One of the Annes*

      Yes, thank you OP. It was awesome to hear about the good resolution (so glad things worked out well), and I learned so much from your description of your country’s legal system.

  3. SirTechSpec*

    So glad you got this resolved! What a mess, and yes, I’ve definitely gotten some weird looks from laypeople when casually observing vulnerabilities even though it’s part of my job.

    A point of clarification: while there may not be much between “hope they come to their senses” and “take them to court” in an official legal sense, in practice there are a lot of steps. Casually mentioning that you’re talking to a lawyer can indeed encourage someone to come to their senses, as can filing a letter such as a Cease and Desist (often written by a lawyer, doesn’t carry the force of law, but serves as a way to say I Really Mean It and proof, if you later do end up in court, that it’s not a surprise to the other party and you gave them a chance to respond.)

    But the main distinction that may not be obvious to a non-US person is that “taking someone to court” is a lengthy process that involves a lot of filing paperwork, lawyers meeting with each other, etc., and along the way many cases are settled before you actually get to your “day in court” where you’re in a physical courtroom yelling at each other in front of a judge and/or jury. (IANAL but I have had friends go through the process.)

    1. LK*

      Good points here. Going to court is HELLA expensive no matter what country you’re in (US/Canada, so even if north americans get lawyers involved earlier, there are still MANY steps done with the lawyers between the initial conflict and going to court to attempt to settle before you end up involving judges and masters.

    2. Dzhymm*

      I would say that in the States, one of the reasons why people tend to lawyer up early and communicate only via counsel is that if the case *does* go to court you don’t want to have messed it up by admitting something that will later bite you in court. The vast majority of cases never make it to court for a number of reasons, but if they do then a casual misstatement along the way could sink your case.

      1. Wintermute*

        As a student of law (I graduated with a prelaw undergrad but never went on to law school because the earning potential increase isn’t great) This is one of the biggest misunderstandings and a fundamental cornerstone of the Lawyer Full Employment Plan that is propagated.

        Many states (I would venture all but that’s a dangerous statement because there’s always ONE state that’s an oddball) have laws that protect “social utterances” or specifically state “an apology is not an admission” and court doctrine has always held that perfectly common language does not have legalistic interpretation or force.

        Now if you’re doing something or saying something highly dumb but the idea that “you could say ‘I see what you mean’ and blow your whole case!” is fearmongering from lawyers that want consult fees and telephone game distortion of the actual facts.

        Remember except in highly unusual cases the law follows a few key principles, like the reasonable person doctrine (essentially “things mean what a reasonable person would consider them to mean, not esoteric, unusual or pedantic definitions”), good faith (the law requires people to deal honestly with one another when forming contracts and not attempt to build in loopholes or act in bad faith to cause unforseeable detriment to the other party), and the requirements of contracts.

        The Law is not a magic spell where saying the right words and performing the right actions will cause results to inexplicably happen, judges can and do use “reasonableness” and “intention” and their common sense.

        1. CityMouse*

          While yes, random utterances aren’t often case-killers, there are absolutely things that people can do that come back to bite them later, particularly people who sign things they shouldn’t or people who wait too long to address something.

          Without being too specific, when I was in clinic (so I was free), I had a client who was totally and completely screwed, but because he had waited over a year to come talk to us, he had gone into certain agreements and had judgments against him that we had trouble getting him out of. If he’d just come to talk to us 6 months earlier, we would have been able to help him a lot more.

          Judges also aren’t magic, they are required to follow the law. When I was a clerk, we would see situations that were very frustrating, but you are still bound by the law. Unless there’s a legal reason to throw out a contract, you can’t just throw it out because it feels unfair.

    3. state government jane*

      IANAL, but I am a legal professional, and came here to say something along these lines. The one thing I’ve learned from working in the field is that lawyers can be helpful for a whole myriad of things short of “time to go to court.” For example, attorneys can sometimes be a good resource when shit starts getting weird with an employer but you’re not totally sure what your rights are or what’s normal. I think it’s important for people to know that, so that they can get the assistance they need (instead of getting scared away by the idea that talking with a lawyer is the fast track to litigation).

    4. CityMouse*

      It’s also because there’s a power differential. Companies often can abuse their authority or do things they shouldn’t, a lawyer can help rectify that situation. We’ve had multiple letters here where OPs were mistreated but a letter from an attorney ended up helping out (think stole spicy food LW). A good lawyer is happy when a quick letter resolves a case and even among cases that are actually filed with the court, very few actually proceed to trial.

      Yes, there are people who abuse lawyers and the legal system and bad lawyers out there. But for the most part, the profession is supposed to be about balancing the scales and using the legal system to obtain equitable results, even when there is a power differential.

  4. t*

    Such a good point about how you need to think about not just the words you are saying but how they might be interpreted by the person receiving those words. I’m glad that talking to a bunch of non IT/info sec people was able to help you refine your approach.

  5. Construction Safety*

    LOL: ” (as opposed to the U.S., where it seems like there’s nothing between “hope they come to their senses” and “take them to court”)”
    No kidding.

    1. Antilles*

      A large part of that is that because the way the US system works, there’s often no real downside risk for companies to play hardball – at worst, they lose and pay something approximately similar to what they would have paid upfront, but it’s far more likely they’ll either pay significantly less (negotiated settlement) or nothing (if you give up due to cost/time/energy/etc).

      1. blackcat*

        Yes, particularly since the system works so that if person/entity A sues person/entity B, and person/entity B never responds/shows up to court, person/entity A wins by default.

    2. Princess Consuela Banana Hammock*

      I understand why OP may see the U.S. legal system that way, but it’s not actually true. There’s a lot of that happens between “hope they come to their sense” and “take them to court,” but it’s possible that those rounds/processes are not spelled out as clearly as they are in OP’s country. For example, many courts mandate that the parties undergo mediation prior to filing a case and also post-filing, and several laws require parties to sort their problems out with administrative agencies, where proceedings have different rules/goals than normal courts. And then you have arbitration clauses, which prevent people from even getting to court. So there’s a lot that goes on; it’s just different based on the legal problem, any contracts you’ve signed, and the State you’re in.

      1. CityMouse*

        Although while arbitration clauses sound like a good thing in theory, they’re often horribly abused and used by large organizations to force individuals or smaller parties into often-inequitable hearings.

      2. Discordia Angel Jones*

        Chiming in to say that in the UK it is similar – we have a “Pre-Action Protocol” here with does involve heavy hinting that one should do a mediation (and other steps designed to push the parties to settle), and if one of the parties does not comply with the protocol, it can have significant ramifications in the case. Even once the claim is issued, there’s a heavy push towards mediation and settlement.

        Arbitration is also used in some industries nearly to the complete exclusion of the Court. Expert Determination is another good one (though, not often relevant in an employment context).

  7. AlaskaKT*

    I’m so glad to hear this update! I know that whole mess must have sucked, but it’s nice to hear that your company came round on the talks.

    Any idea what happened to Super Hostile HR Person after all of this? I’d be curious to know since part of things moving smoothly was removing that person from the process.

  8. Howe*

    Thanks for the update, OP! The states is definitely excessively litigious with a very unhealthy legal system so it’s fortunate that your country approaches things from a more compassionate perspective It sounds like everything worked out in the best way that it could. I wish you the best.

    1. Bryce*

      I think I’d describe the US legal system as “very focused on the form, rather than the function.” The reason the first response to anything is “get a lawyer” is because if things DO escalate, a misstep early on can derail the whole matter. If you don’t document something right, then legally it didn’t happen. Now that’s to prevent abuse the OTHER way but the legal system’s such a jumble that without help navigating it proper documentation isn’t always obvious.

    2. Questioning*

      I’d like to know why you think the United States has “a very unhealthy legal system” that is “excessively litigious.” Businesses around the world use New York law (along with English law) to govern contracts and Delaware to incorporate many companies. The common law system is a tremendous strength, not a weakness. And on the consumer protection front, I think the US legal system has put consumer safety front and center. More could be done on the employment law front, but that would probably result in more litigation, not less.

      1. GermanGirl*

        Well, from a German perspective the consumer protection rulings are crazy over the top in the US. In a lot of cases that got media attention over here (so probably the most extreme cases) a German judge would just tell the customer to use their common sense and the company to not worry about it.

        I vaguely remember someone sueing a coffee chain because she spilled hot coffee on herself because the paper cup didn’t say it was hot.
        A woman sued a restaurant because she threw a drink into her boyfriend’s face and then slipped in the puddle and broke her tail bone.
        And a guy who sued the motorhome company because he put the tempomatic on and went in the back to make himself coffee and then crashed.
        And these people all won their cases.

        So yeah, it surely is a biased view because of the press coverage but to outsiders it looks like people in the US sue for any reason and common sense doesn’t always play a role in the rulings.

        1. Gadfly*

          Okay– the hot coffee thing? Coffee hot enough to burn an elderly woman’s genitals to the bone. This wasn’t “coffee is hot” it was a restaurant knowingly and after repeated warnings serving something at dangerously hot temperatures to make things easier on them.

          http://www.lectlaw.com/files/cur78.htm

          1. Questioning*

            The coffee wasn’t merely hot. It was SCALDING. Outside safety consultants had, repeatedly, told McDonalds to cool down the coffee it served. They refused.

            Sorry, but in my book if you compare a system that deters an 80-something woman getting third degree genital burns to a system that shrugs the problem off, I’ll take the former in a heartbeat. The system worked.

        2. Some sort of Management Consultant*

          While I do think the US system is rather odd, the “spilled coffee” story is widely misunderstood.
          The woman who got burned got terrible burns and McDonald’s had been warned repeatedly that the coffee was dangerously burned.

          Basically, that story is not the best to use when illustrating the US legal system.

          1. Kathlynn*

            Yeah, and all she wanted was for McDonalds to cover her medical bills for the burns, because she had horrible 3rd degree burns. (she also didn’t end up getting the millions the jury suggested she be awarded)

            1. CityMouse*

              The jury also found contributory negligence and reduced her award proportionally.

              It really shows you don’t understand torts if you cite that case as ridiculous, because it’s actually a classic example of a tort (if you’re doing something unsafe, and were warned something is unsafe and then someone gets hurt, you’re going to be on the hook and likely pay punitive damages) and the lady was very badly injured.

            2. sstabeler*

              for that matter, tort reform often irritates me since it’s almost always a hard cap on the amount of money that can be awarded in compensation. If I was badly injured due to someone else’s negiligence to the point that it caused me bills in the millions, you can be sure I’d want them to pay every last cent of those bills.

              it would probably help quite a bit, actually, if there was something of a tweak to what happens with the different types of damages. for compensatory damages, they should go to the plaintiff. However, if PUNITIVE damages are awarded, those should be treated like a fine for the behaviour by the company- as such, those DON’T go to the plaintiff, but to wherever fines go. (the idea is that a misbehaving company can be required to pay enouhg that thye can’t simply write it off as a cost of doing business, but you can’t literally seek millions of pounds for a spilled cup of coffee. (I think we can all agree that actually demanding millions of pounds in compensation for a spilled cup of coffee would be ridiculous. however, the woman in the case in question quite reasonably wanted McDonalds to pay the medical bills. (granted, how I would have done it is that since- I think- she had the coffee cup in a fairly stupid place, I would have assumed the spill was inevitable, and seen how much damage would have been done if the coffee had been served at the right temperature- damages awarded would be the costs incurred due to the extra temperature. )

        3. Sarah*

          The coffee was being served at dangerously hot temperature, like near boiling, when Food Safety laws outline safe temperatures at which food can be served so they can be edible. The woman in question needed skin grafting. It was a company-wide safety issue and other companies were serving their hot beverages at safer temperatures. This is so frustrating-the US certainly has some things of which we should be embarrassed, but there is also misrepresentation. I was watching a panel show a few weeks ago and they were having a go at Chelsea Peretti for the US having recently elected Trump and she said, ‘Oh yeah, because your leaders always tell the truth.” I really bristled at the line in the follow-up about what the OP said about how we handle our cases.
          As for our legal system, you should hear American perception of the courts in other countries. When the Amanda Knox case was making headlines, we were aghast at how Italy handles things.

          1. GermanGirl*

            Yes, of course. I think there are two factors at play here, one is that you only hear about the strangest cases because all the boring sensible cases never make it into the international press, and two those cases that make it into the press are then fitted with clickbait headlines or teasers.

            I certainly didn’t know the background of the hot drinks incident even though I googled it before posting, because most news sites don’t bring the background.

            1. CityMouse*

              That’s really often the case with those “ridiculous lawsuit” articles. They’re often either leaving out huge facts (like the fact that the McDonalds lady was really horribly injured because the coffee was absurdly too hot), or they’ve omitted facts like “the case was dismissed almost immediately for failure to state a claim”.

            2. Jessen*

              There’s also the fact that the U.S. system really has no checks on who can file a lawsuit. So pretty much anyone who feels wronged can file anything they want, no matter the legal merits. There’s a lot of stupid cases that get thrown out pretty quickly.

              1. Erik D.*

                You can be sanctioned or even barred from filing suits if you file too many frivolous suits (of course that depends on the state as well).

              2. Anonatty*

                I actually encountered a guy who had been jailed briefly for contempt of court (he also threatened the judge’s staff) for filing frivolous lawsuits. He had filed something like 200 in one jurisdiction alone, not counting the ones in other states and federal courts. Yes, he’d had court ordered psych evals. Yes, these were quickly dismissed.

                Anyone with a pen and either a filing fee or the ability to fill out an in forma pauperis form can file a lawsuit. Some don’t last very long.

        4. Questioning*

          I’m a corporate lawyer, and I’ve worked with many German and other European companies on transactions. They almost always choose NY or English law in their international contracts when doing business.

          When you bring up the McDonald’s case and such, you’re focusing on an extremely narrow area of law — tort law — to the exclusion of all else. When it comes to business/corporate law, people who actually are experts in the field repeatedly go to common law countries.

          As noted below, even on tort law, I don’t think the evidence is so clear-cut. If some German judges tells an 80-year-old woman with third-degree genital burns to “use common sense and not worry about it,” I don’t see that as evidence that all is A-OK in the Germany system. (In actual fact, though, that doesn’t happen so much as you’d think, and many countries have mechanisms, such as expanded worker’s comp, that effectively accomplish the same thing as tort law. I’m not a torts guy, though, so I’m speaking from outside my bailiwick here.)

          I do recall once hearing another German person on a blob make the same point you’re making, and he was bragging that you never saw product disclaimers in Germany and that Germany would happily let elderly men slip on ice and break their bones and do nothing. The blog guy was shut down when someone posted a “use at your own risk” sign hanging on the Deutshe Bahn. A few months later on a Lufthansa flight, I sat next to a German lawyer who explained that the blogger’s theory was rubbish, and that in fact Germany has something like strict liability (i.e, liability even if you’re not at fault and have done nothing wrong) if someone slips on snow/ice on your property.

        5. Candi*

          The woman’s name was Stella. Everyone else has covered most of the points, but I’d like to mention that McD’s had already paid out on half a dozen cases of scalding via too-hot coffee before her case. For some reason, the company rep got snippy with Stella’s case, and history was made.

          The guy who started the stella awards site and books apologized for naming them after her when presented the facts of the case. He detailed the story in one of his books, and explained how it wasn’t frivolous.

          The motor home case is a known urban legend. Who, when, and where it happened has never been confirmed.

          One of the issues with filing suits is, as far as I’ve read, many districts in the US allow pleading of inability to pay to file without fees. The idea and ideal is to allow everyone access to the legal system. A result is people filing over silly things and ruining it for everyone else, from clogging the input of the system to having to show proof of income and such. There’s a reason there’s a trope about Why We Can’t Have Nice Things.

          1. sstabeler*

            It’s not actually filing the suits themselves that causes issues, it’s the costs caused by the discovery process- which is largely unique to the US. (while the UK system of Disclosure is similar in many ways, in the UK, you can object on the grounds of excessive cost- or effort- to pats of a disclosure request. (for instance, they could likely argue that checking all the emails in the company for anything related to the case is unreasonable, but they have checked the email accounts of those the filing mentioned were involved.))

        6. Anna*

          I’m going to be very calm about you trotting out the old “hot coffee” canard. It’s old and fundamentally flawed as an example of our overly litigious society. I would recommend a two second Google search on what that case was really about before off-handedly using it as an example of what’s wrong with the civil system in the US.

      2. Katelyn*

        Delaware is a known tax haven jurisdiction. The only reason they’re not (as) blacklisted as other areas (e.g. Luxembourg) is because they are located within the USA, not their own country. If they were their own country they would be considered a very high risk jurisdiction for money laundering and tax evasion. I look into company formations for a living and groan when I see a Delaware incorporation document because I know how difficult it will be to find the actual human owners of the company in the layers of mush they’ve put in place.

        I’m sure US law is great in many ways and for many people (libel laws for example?), but drop Delaware incorporations from your argument!

  11. Bryce*

    Thanks for the update, glad it worked out. Including the security changes in a “here’s a list of things that need to be transferred” note was a good idea, helps clarify it as the goodwill gesture it was meant to be.

  12. Myrin*

    How wonderful, OP, I’m really happy all this has played out in your favour in the end!

  13. GlamNonprofitSquirrel*

    I love updates! Great work, OP. I especially appreciate all of the clarification about the process in your country vs the US norms. Good stuff!

  15. Paul*

    Glad for the update! I was amazed at how many people had a hard time believing a company had crap infosec.

  17. Kira*

    Beautifully handled response – and I really enjoyed how you communicated your situation with us (here on AAM) overall. I’m sorry you’re going through this tough time.

  18. Ellen N.*

    Thank you very much for this update. I found your description of your legal system and how it differs from ours in the U.S. to be interesting.

  19. stk*

    Well done, OP, what a great update. And nice job turning the discussion in the comments into productive, practical steps to sort things out!

  21. Julia Gulia*

    I really like the point regarding how infosec people are wired to look for flaws and how laymen see it as “scary hacker talk”. It reminds me of how a veteran friend explained to me that it is a permanent part of him to always check a restaurant for all exits, always size people up for weaknesses, and so on. It changes how your brain frames the world around you.

  22. Princess Consuela Banana Hammock*

    OP, this was an amazing update, and I’m so glad that this resolved in a way that worked for everyone. It sounds like having a framework that encourages people to come up with solutions really helped shape the framework for your conversations (and it’s so thrilling to hear that commenters were able to provide scripts!).

    Re: the comments encouraging you to go through your lawyer, that advice is certainly informed by having a different legal system, but it could also be the product of different ethical rules and rules of process. For example, most states have ethics rules that require lawyers to speak only to one another when both parties are represented (i.e., your lawyer couldn’t speak casually to your boss, and your ex-employer’s lawyer could not call you without notifying your lawyer). Second, people oftentimes can destroy their case, make litigation more likely, or increase their legal risk by failing to clear things with their lawyer ahead of time. It sounds like you were protecting against #2, just in a more structured format than how that kind of advising takes place out here (although the arrangement you described is really common, even in the U.S.!). I just wanted to clarify that it’s not driven exclusively by a culture of litigiousness :)

  23. Stik Tech Drone*

    Hi OP just came to say your letter was one of the best pieces of writing I’ve read in a while. I am glad you were able to maneuver your way out of your predicament, to a somewhat satisfactory result.

    Best of luck OP, I hope your next job blows this one out of the water.

  25. MassMatt*

    Great update, I’m impressed that you took the high road with your former ER even when you were tempted not to.

    And great work in handling the comments, glad there was useful stuff there among the folks not understanding A) that your legal system is different from the US model and B) how people dealing with IT/Infosec think and talk about it vs: lay people.

    Sorry the situation crumbled there, if your letters here are any indication then I’m sure there are tons of places that will be thrilled to hire you. Good luck!

  26. nonegiven*

    Most dealings I’ve have with lawyers were never going to involve court. A lot of things lawyers do involves keeping you out of court.

    1. GMN*

      I get this, and I’m sure there are a lot of great things about US law, but just a thinking point: in my country you generally don’t need a lawyer to stay out of court. I don’t think I know anyone that has needed the services of a lawyer.

  28. Old Admin*

    Well done, OP! If you’d like a real change, come and work in Germany – they are desperately looking for tech people, and protection of disabilities is very good. :)

Comments are closed.