back to article Rogue IT admin goes off the rails, shuts down Canadian train switches

A former IT administrator at the Canadian Pacific Railway has been jailed for 366 days for sabotaging the organization's computer network. Christopher Victor Grupe, 46, had a rocky relationship with his employers: in December 2015, he was suspended for 12 days for insubordination and just not making the grade as a sysadmin. …

Bronze badge

Normally you disabled a person’s accounts first before telling them they’re fired...

Sounds like several people (in IT & HR) need to be told they can no longer play with the choo choo’s.

146
1
Silver badge

Upvote as it seems the company didn't do their due diligence. I'm surprised that the judge or even the forensics folks didn't rip the CIO a new one or maybe they did but no one's talking.

57
4

> . I'm surprised that the judge or even the forensics folks didn't rip the CIO a new one

I'm not. When I worked IT admin, management (not just from one company) would frequently "let someone go" with out informing us. For the most part we were lucky in that the only damage done was a deleted mailbox (recoverable) and a mouse lead being severed (£3 to replace). And sure, after I would then have a chat, the next few dismissals we were informed just before the meeting, but inevitably it slipped again after a few months, or new managers. Rinse and repeat.

50
1
Silver badge

Keeping his accounts active while he's being fired - that might be considered a single slip.

But letting them stay active afterwards for at least 2 days - that has to be a double slip.

32
0
Anonymous Coward

Bollocks. An IT professional should be exactly that. People who pull this kind of shit should be barred from the profession for life and receive much tougher penalties.

40
5
Silver badge

"Bollocks"

Which post were you referring to? Without quoting what you think is bollocks your post becomes self-describing.

13
11
Silver badge

"I'm surprised that the judge or even the forensics folks didn't rip the CIO a new one"

Why would they? Failing to run a business according to best practice is not generally a criminal offence. If you leave your door unlocked and someone robs your house, it's not the judge's business to tell you you're an idiot, he's only there to sentence the burglar.

40
1
Silver badge

Classic...

... Especially when you've just had the person come off the naughty step.

Hell, in some employers, you'd be escorted back to your desk to collect your personal belongings only, in others, you can collect them at the end of the/on the next day in a box.

18
0
Silver badge

management (not just from one company) would frequently "let someone go" with out informing us.

The problem is org charts. HR have a visceral resistance to the reality that on a day to day basis a SysAdmin is a far more powerful (and therefore potentially dangerous) individual than a CEO and consequently needs to be handled with greater care.

The same thing happens in DCs. People get awestruck by CTOs and (to a lesser extent) networking guys and forget that regular electricians and aircon plumbers underpin everything[1].

[1] Based on a "logic bomb" left by a disgruntled sparky. A few breakers were "accidentally" miswired so that when a scheduled power down happened three months later the wrong aisles got powered off which also unbalanced the 3-Phase with assorted domino effects. The miscreant was long gone back to somewhere in Eastern Europe by then.

25
5
Anonymous Coward

Although I live in the UK I've worked for US and CDN companies for decades.

I find it bizarre that over here you can be fired with several weeks notice, and can be expected to continue doing your job and set your house in order for a smooth transition - while in North America, even if you've done nothing wrong, you are called into a meeting, have your accounts locked, laptop removed and are escorted from the building, leaving colleagues to cope with the fallout.

The latter approach just seems to make for very angry and aggrieved ex-employees, and places a burden on remaining staff who have to pick up the pieces.

41
1
Silver badge

Single slip, double slip

@Simon Harris: both good points (in British English).

5
0

"I find it bizarre that over here you can be fired with several weeks notice, and can be expected to continue doing your job and set your house in order for a smooth transition"

Not that I'm massively experienced but I've never seen anyone fired for misconduct and been allowed to continue working. I've seen people made redundant and work their notice period as you describe above.

25
0
Silver badge

Judges are usually not big on victim blaming. Or at least, when they do it's them that gets a new one ripped.

10
0
Silver badge

"after I would then have a chat"

This is _why_ you need documented procedures for these kinds of things.

It doesn't just mean that corporate memory is preserved across staffing changes, it means your ass (and others) are preserved in the event that someone doesn't bother following them.

10
0
Silver badge

"over here you can be fired with several weeks notice, and can be expected to continue doing your job and set your house in order for a smooth transition"

The difference is that here, if you're being made redundant (vs "fired") you're going to be given a severance package and a reference which are both at risk if you do anything stupid.

If there's a hint that you won't play nice then your notice period will be spent at home, gardening, with all access codes having been changed before you were told about it.

The USA in particular has this peculiar concept of "at will" employment (which the tories keep trying to introduce here) which means that noone's job is secure from one day to the next - and one of the favourite manglement tactics when firing a lot of people is to parachute XYZ inept manager into the location with promises of long term upgrade to start sacking people ("hoorah", he thinks), and then push him out the door with no compensation when the dirty work is done.

17
5
Silver badge

"This is _why_ you need documented procedures for these kinds of things".

I've ended up writing such procedures on the way out in previous jobs - which is not ideal. Thankfully, these were positions where my departure was on amicable terms - but this isn't the sort of thing you want to do when the person is annoyed and would like to see their (now ex-)employer go up in flames like a Bond baddie's secret volcano hide-out.

6
0
Bronze badge

I have seen people work out their gardening leave.

I've also seen people walked to the door and it leaves the whole office in a state of shock and everyone, except hr, goes home early that day.

7
0
Anonymous Coward

> An IT professional should be exactly that.

> People who pull this kind of shit should be

> barred from the profession for life and receive

> much tougher penalties.

And all IT professionals should be bonded. It's still amazing that with the kind of access that IT folks get, they don't have to post a serious bond.

5
8
Stop

HR 101

Honestly, you'd think it would be written into HR and Management manuals by now: if you have an employee who is showing signs of being likely to become an ex-employee, then when you fire him you lock his accounts first, then you inform him that he is being terminated and that his remaining tenure with the company is gardening leave, to be spent off-site.

Otherwise, try to conduct all such business with the maximum of politeness and dignity, so as to preserve your company's reputation and minimise hurt and annoyance to the soon-to-be-ex employee. Pay a little more than statutory minimum redundancy payments, extend health cover for a month or so, basically be nice to the bloke you're firing and with luck he'll be nice back to you.

20
0
Silver badge

And all IT professionals should be bonded

Or how about mandatory professional indemnity insurance and maybe a professional body? I suppose there's a question then of what types of IT professional need to be protected in this way - where would you draw the line?

M.

4
0
Anonymous Coward

@Doctor Syntax and "Which post were you referring to"

He was replying to the first post, you can tell by the little arrow and match it up with how long since post, admittedly not obvious but forgivable if he has never posted on thereg before and was unaware of the interface.

3
0
Anonymous Coward

Re: I have seen people work out their gardening leave.

I have seen people try to pass through the turn styles only to find their passes have been disable. They're handed a letter and told to go home and await the meeting to be scheduled. IT access has also been similarly revoked.

Gardening leave was enforced and a severance package was available at the time.

Location: UK.

2
0
Bronze badge

Happened like that for me

Our entire office was made redundant but we were all allowed to continue using the facilities for preparing/updating CVs, arranging interviews and just generally faffing about. Any faffing had to be legal and within our T&Cs, so no downloading pirated stuff, no browsing pr0n sites and so forth.

As far as I know, nobody abused it.

2
0
Anonymous Coward

Re: I have seen people work out their gardening leave.

Well yes, because HR go home early every day.

0
0

Re: I have seen people work out their gardening leave.

@AC "HR go home early every day."

It would be better if they never came in.

3
0
Anonymous Coward

"while in North America"

Well, yes and no. I have seen employees escorted off the premises and others given weeks to wind down gracefully in the same company (and both for people quitting and being let go). Depends on the individual BU.

1
0
Silver badge
Coffee/keyboard

First prize

for jokes in a single El' Reg article that were actually funny goes to Iain.

10
2
Bronze badge

Re: First prize

It's a matter of scale, I guess; not HO-HO-HO funny, by my gauge. Still, your mentioning the humour might spur closer scrutiny down the line.

37
0
Silver badge
Thumb Up

Re: First prize

yes, just to name a few:

Canadian railway employee had - a rocky relationship

Dying network named CPR

and finally the IT/Locomotive double entendre - Management blew its stack

22
0
TRT
Silver badge

Re: First prize

I was initially confused by the reference to switches. I thought someone had sabotaged the points.

50
1
Silver badge

Re: First prize

Roses are red

violence is too

all these dumb rhymes

lowered the threshold for you.

14
0
Silver badge

Re: First prize

This needs a pic of a moustachioed villain in a black hat and cape grappling with a big lever in an old signal box while his female victim writhed on the tracks and the express approached.

27
0
404
Silver badge

Re: First prize

Perfect! Dudley Do-right of the Mounties will save the day... Works cuz he's Canadian ;)

7
0
Bronze badge

Re: First prize

With said victim shouting for help in a thick Texan/Southern accent.

2
0
Silver badge
Coat

Re: First prize

With said victim shouting for help in a thick Texan/Southern accent.

It might be more appropriate with the victim shouting in a Kansas City Southern accent...

1
0
Silver badge
Unhappy

Major delays, screwups, cancellations and basically everyone running around trying to figure out what the hell's going on?

Sounds like a typical day riding the trains in Sydney.

18
1
Holmes

Put pressure on him

Nice of them to let him tender his resignation. Maybe he should get a coach -- not get side-tracked, get the wheels rolling again, etc. Too bad there wasn't a whistle blower around to stop him.

25
1
Silver badge

Re: Put pressure on him

Maybe they should have revoked his accounts and ID, then rode him out of town on a rail ?

5
1
Silver badge

Re: Put pressure on him

Maybe they should have been on their guard against such behavior.

1
0
Anonymous Coward

So did the accused admit his guilt?

I ask as forensic experts "got in" by an employer is not the same as an impartial police investigation and certainly not be accepted as evidence equal to a real investigation.

Again not shutting his access down is just inviting trouble and should be viewed as being equivilent to leaving a window open.

Perhaps the reason original arguement requiring his dismissal was about how incompetent his management were

14
6
Anonymous Coward

Re: So did the accused admit his guilt?

^ someone got a guilty conscience? Your analogies are nonsense; an open window is not an invitation to anyone other than criminals.

8
9
Silver badge

Re: So did the accused admit his guilt?

^ someone got a guilty conscience? Your analogies are nonsense; an open window is not an invitation to anyone other than criminals.

You got a point, but (continuing the anaology) it's also an invitation for Insurance companies* not to pay up, should something happen in said circumstances.

* You are free to argue said companies are also 'criminal' of course.

22
0
Anonymous Coward

Re: So did the accused admit his guilt?

"open window is not an invitation to anyone other than criminals", no you are just plain wrong, security is everyone's responsibility.

An open window, at court, is the difference between breaking and entering (a crime) and entering to dick with you by turn off some of your electric equipment, changing the recording times on your PVR (not a crime) or any other action that doesn't break the law.

Hence one is a crime the other would be a civil case at best, this because not taking security seriously costs everyone else money and is correctly seen as incitement by the courts.

Here we have a prime example of failing to implement minimum security practices and personally I would say the company is far from innocent in this. If they had removed all access at the point where he was suspended or at very least when he left then there would not be any court case to hold.

2
12

Re: So did the accused admit his guilt?

The guy was fired and his creds not wiped, presenting the open window for criminals, who may or may not have been the man on trial, to do malicious damage, or something just happened and the recently dismissed / resigned was blamed with evidence corroborating it.

I’d like to see remote access, ad and tacacs logs proving he logged into that laptop and did those things before he wiped it and handed it back.

For a tech site, we can surely expect the journo to include info on these details.

7
0
Silver badge
FAIL

Re: So did the accused admit his guilt?

@AC Actually the two cases you've cited would be "breaking and entering" if the Windows were shut and "criminal tresspass" if the Windows were open.

Just because a window was open, doesnt give you ANY right to climb into another persons house without there permission.

What you do inside the house would just determine if there were other crimes you were charged with. oh and by the way things like "dicking around with your Equipment" would likely bring a criminal mischief charge.

Playing with other peoples toys, with out their permission, is just not allowed...

12
0
Silver badge

Re: So did the accused admit his guilt?

Less like an open window and more like failing to retrieve all the keys from the Ex.

4
0
Anonymous Coward

Re: So did the accused admit his guilt?

Having worked for a number of bad employers then when I see these sorts of news storys then I always look at what information has been released before making any judgement.

One employer I worked for was still blaming a guy who left to go contracting for every failure two months later regardless of if they guy had ever touch it. I didn't know the guy until they finally had to pay his rates but my dealings with his work suggested that he was more competent than 90% of my peers.

Another had the a network admin grilling the staff and starting the dialogue with "we found evidence on a machine you used and the timestamps say you did it" when this was a complete lie, when they tied it with me I said "this isn't amature hour, lets bring the police in" and they bricked it.

One company had managed to turn a clients multi CPU novell cluster into a single CPU fileserver after the manager's friend rebuilt it and then made the client upgrade the network and switch to Microsoft to hide the fail.

I could go on but basically I have worked with a lot of bad managers who in my experience truely believed that they could do or say anything.

So if the only proof here is the say so of some "third party" investigator who was employed to find evidence against the dismissed employee then I am going to wonder if it is just more bad management covering their own arses.

That the management admit failing to remove the dismissed employees access just adds icing to the cake

8
0
Anonymous Coward

Re: So did the accused admit his guilt?

@AC "An open window, at court, is the difference between breaking and entering (a crime) and entering to dick with you by turn off some of your electric equipment, changing the recording times on your PVR (not a crime) or any other action that doesn't break the law."

Window open or not isn't really relevant, entering someones house/private property uninvited is still trespass, and so is a crime. Even in the US just entering a location without permission can be classed as burglary, even if nothing was taken or no other crime committed, it just has to be shown that you have no valid reason to be there.

1
0
Anonymous Coward

Re: So did the accused admit his guilt?

US law of "criminal tresspass" I presume, still IMHO does not make just being on someone else property a instant crime but it is the US after all and since there are a lot of lawyers making the laws then it is possible.

In the UK we have people coming onto our property all the time to deliver mail, tell you to buy a TV license trying to sell you something or get you to contribute towards the charity who employ them on commission and whilst the later can be annoying we the tax payers are paying for the courts and the solicitors to have their time wasted because some tool can't be bothered to secure their home or is after an insurance payout.

For my part I would prefer to keep my front garden than shoot people if they step on my grass but then again I am not in the US.

3
5
Silver badge
Facepalm

Re: So did the accused admit his guilt?

@AC You're changing your definitions. You were talking about people coming through the window, not someone walking on your front lawn. If your mailman climbs through your window to deliver your post, believe me you are well within your rights to call the Police and have them arrested for tresspassing. Even in the UK. Same with TV licence people and charity collectors. You are also welcome to call the Police on them again for tresspassing if they were to climb into your back yard for that purpose. The front yard, however, usually allows for entry for the purpose of movingto your front door. if they decide to set up a rave in your front yard without your permission, then again they are tresspassing.

It's not so difficult to understand, now is it?

4
0

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Forums

Biting the hand that feeds IT © 1998–2018