Employee's silent rampage wipes out $2.5m worth of data

A Florida woman who believed she was about to get fired has been accused of deleting $2.5m worth of computer files to seek revenge on her employer. Jacksonville Sheriff's officials say Marie Lupe Cooley, 41, used her own account credentials to access the server of Steven E. Hutchins Architects and delete seven years' worth of …

[Pete]

wot, no backups?

How can a business have such a high value of assets unprotected (from hardware failure) by keeping them on just a single server?

What if they had a fire, or disk failure, or someone nicked the whole damn box. It amazes me just how irresponsible businesses still are, even after decades of banging on about security and backups and redundant copies we still get businesss who rely on the pure dumb luck that theor box won't fry itself, or some trainee won't accidentally reformat something.

[Rodrigo Valenzuela]

backup?

If your data is worth $2.5m, you would have a good backup. Don't you?

May be more than one, if they are really critical.

[Darren Coleman]

No backups

"He declined to say if he had stored backups of the files"

So in other words they didn't have any. Who would they be blaming if they'd had a hard drive die on them? Strikes me that this employee maliciously wiping the data is somewhat incidental.

[Anonymous Coward]

well

backups or no she's still a crazy cow who tried to inflict criminal damage on her employer.

The guy probably doesn't know what a hard disk is.

[Anonymous Coward]

@ all of you crying "backups" / Darren Coleman

Maybe they didn't. Maybe they did, and he doesn't want to reveal that. Maybe the backups were a little old, and the latest versions were made of blood, sweat and tears. Either way, it still doesn't excuse the deliberate deletion of them on nothing more than a vague guess. "Incidental" my arse.

Regardless of the firm's data backup policy, she was still a paranoid, disrespectful cow. I think you're all rather missng the point somewhat.

[Dunhill]

too easy

c:\freezta\dllbackup.16\43677aebcdd887621\ibmdos\undelete.com c:\lastus~1\mydo~1.5* /s /yes

[Darren Coleman]

Re: Anonymous Coward

Don't think anyone is saying that she isn't fully to blame for this incident, nor that she shouldn't face the full legal consequences. However, whether she maliciously wiped the data or a vital component on the server died of its own volition (which if anything is more likely to happen than scenario) - the result would be the same.

I have little sympathy for companies who don't operate backup policies commensurate with the value of the data they are looking to protect. I also don't see why a company would necessarily be clandestine about whether they had backups or not, unless of course they didn't have any.

[Ryan Barrett]

Sounds like an **AA calculator...

..though it is missing a few zeros for that..

[Anonymous Coward]

Backup... We don't need no stinkin' backups...

We just found out that our company doesn't backup our engineering servers. Luckily for me, I keep a duplicate copy on my workstation due to people screwing up files on the server. No use putting myself through the hassle of working harder due to someone else's problems.

Of course, I would have been cheaper to pay me the same as our I.T. guys and just have me stand around and back up the systems.

Now, I don't know the cirmcumstances, but if the work environment resembled the one that I work in, I could understand it. I don't really care for the 'she should have just quit' argument, because that's a cop-out for dealing with the fact that something was really wrong between her and the company. That kind of attitude just doesn't magically appear.

[Alan Lukaszewicz]

Hang easy

An architect valuing stuff at 2.5 million is probably a couple of orders of magnitude out added with a dash of exaggeration (fee payers doncha know?)

Hasn't anyone told the architect of Time Machine?

[yeah, right.]

fake value

There data was not "worth 2.5 million". The projects the data were for might have been worth that much at one point, but I really doubt that if the data itself was really worth that much that they would not have any backups whatsoever. Sounds like something a lawyer, system admin or manager would come up in order to qualify for a better insurance payout in this case. Hell, I've assigned such fake values to data myself in order to qualify for a better backup budget. I can see why they did it, but in this case they are lying to the court.

[Jon Bright]

Maybe she killed the backups too?

If she's the sysadmin, she's presumably in charge of the backups. If she's going on a deletion rampage, why not send the backups for a dip in the Atlantic while she's at it?

[me]

I say...

Fire them all!

(Probably no off-site backup for the backup either.)

[Paul Murray]

Value

The data could easily have been worth that much. How many hours of work? How many people working? How much per hour?

It stacks up pretty quickly.

[voshkin]

consultant

"It was not a sensationalistic amount of money," he told El Reg, referring to the fee he paid a consultant to dredge up the discarded architectural drawings.

I can see this conversation quite clearly in my head.

- Help! I have 2.5Bn USD worth of data DESTROID *cries*

- Err, ok, it will cost you 1m USD

- TAKE TWO! Just recover my data

A quick recovery with *any recovery program on the market* and, “where do I get my 2m USD?”

What can a consultant possibly do... unless she physically took the hard drives out of the severs, and through them from the 20th floor, or whipped the hard drives several times (unlikely) any bloody child can recover the data.

P.S. why am I never around when such morons are looking for a “consultant” I can even make it look good, by running cmd.exe full screen, and typing stuff just like in the movies...

[I. Aproveofitspendingonspecificprojects]

@yeah, right.

If the drawing were ever required during the life of the building, they would be worth a substantial amount to the architect.

It's unlikely that he would require all of the seven years worth. Any idea how many building that might entail? 7 years worth of work or 4 hours worth of deletion.

Sounds substantial either way. And CAD software isn't that cheap either. I think 2.5 M sounds fair. I would certainly press for higher damages than the cost of the IT resolution.

Pity they can't.

At least no lasting damage was done, quite the reverse. They learned a useful lesson that may stand them in good stead if they ever lose an hard drive/raid array and they got rid of a really nasty person.

No loss there. And the bill is tax deductible, I imagine.

A good result was had by all.

Maybe even a party after her sentence.

[Gordon]

If...

> If she's the sysadmin...

And if she isn't then she shouldn't have been able to do this anyway. But, like the backup question, we can only surmise. Bet she wasn't and there were no backups, though.

[Anonymous Coward]

Data recovery

The only way of really deleting data (that wasn't backed up to another location), is to delete it from the hard-drive AND afterwards fill up all the remaining space with something else - it's enough even to copy and multiply all the files that still remain on the hard-drive.

Takes a bit, but it's sure not to be recoverable without any backup to another location.

A normal delete (and i don't mean "send to Recycle Bin delete) only marks those files for deletion, and removes them from display - but there are at least a few tens of programs for every OS that can scan the hard-drives and recover files that were marked for deletion before anything is overwritten on that space.

[tony trolle]

sounds cheap

its the cost of man hours to draw them. remaking them would cost more. I belive the owner did not have backups quote from the Jefferson himself "The lesson to be learned here is that you can't depend on having just one set of records or files and having your employees have access to them. You've got to have some kind of backup"

[Anonymous Coward]

@ AC:Date recovery

"A normal delete (and i don't mean "send to Recycle Bin delete) only marks those files for deletion, and removes them from display"

Erm... you're posting comments like that on El Reg? The site where everybody knows an rm -rf / when it leaps up and tries to bite them? I don't think you have to insult our intelligence by explaining that the Recycle Bin doesn't actually delete files...

Personally, I'd boot Knoppix and leave it running overnight with dd if=/dev/zero of=/dev/hda bs=64M count=10000000 or something. shred -n2 /dev/hda is an option too. Honestly, there are a million ways this situation could have been a lot worse.

[Stephen Jackson]

A note to all employers / team leaders

This is why you are ALWAYS open with your staff about ANY open positions in your company, and if it is in a different office, be specific which office! The simple fact of the matter is that employees rely on their job to feed their families and pay their rent. Without proper information about open positions (and especially one that has not been internally announced) they are likely to become paranoid and even resort to crazy acts of desperation or "revenge" in cases where they feel or indeed there job is being taken away from them...

I am not trying to justify it, I am merely saying... this is a real risk factor that employers everywhere should consider any time they advertise a job. Have an internal bulletin board, or simply mail it out to the staff - say who is doing the employing, which office they will work in, and what the job description is... Furthermore, don't go over the top with secrecy when engaging business discussions with other companies unless its absolutely necessary (if there is an NDA in place for example)... people always fear the worst when they know something is going on but the boss doesn't tell them... ironically, 90% of the time, whatever it is will not effect that person..... Avoid open plan offices as much as possible - if this is not possible, encourage employees to use a meeting room if they need to have private business discussions. Most discussions in an open plan office must be whispered, as not to disturb other employees... employees in close proximity can sometimes get the idea that it is them whom is the subject of discussion... and then of course, the ensuing paranoia.... I have seen this happen so many times..... Just sit down and think about all the times YOU have been paranoid, what caused it, and what changes you can make as a boss to prevent that from occurring in your office....

//Steve

[JC]

Took a long time

Either she didn't have a clue what she was doing, or in that FOUR HOURS(!) she was there, she'd have had ample time to mess with the on-site backups.

However, the interesting part is that they're probably going to try for damages at the value of the files - files that they already admit aren't lost.

In other words, the actual damages are only the actual files still lost, downtime, fee to the data recovery expert, and time to assess the restored files. I'm sure they'll pad that figure as much as possible but I'm suspecting that if it were just a basic mass file deletion the total shouldn't be over $15K or so and not knowing the circumstances, might've actually been quite a bit less (or more).

[Ben Gibson]

@ Data Recovery

Every OS also has a method of really removing files from the HDD instead of the normal marked for free space method done to save time the usual way. Really without knowing how she did it all talk is pointless.

[Anonymous Coward]

Language Massacre

Never mind this backup crap: "It was not a sensationalistic amount of money" the guy says.

Doesn't he mean 'sensational'? Surely we can count on El Reg to smooth over little linguistic cock-ups like this - unless they want us to laugh at the person involved, of course ....

[A J Stiles]

@Data recovery

That's why, if you want to make sure something is deleted, you should first keep saving junk data until the drive is full (high DPI scans in .bmp format, and recordings of static in .wav format, are particularly good wastes of space), *then* delete it. Now the only free space to save anything, is where you just deleted your unwanted files from. Keep saving more junk (smaller files this time) till the drive is full again. This means the space formerly occupied by your unwanted files must have been overwritten. Then remove all the junk and finally, defragmentate the disk.

Evil penguin-shagging communists (TM), of course, can just use `dd if=/dev/zero of=/path/to/foo` to overwrite a file with zeros.

[Matt Bradley]

@JC

"In other words, the actual damages are only the actual files still lost, downtime, fee to the data recovery expert, and time to assess the restored files."

How about that awful, head spinning, stomach churning moment when you first access the file server and THERE'S NOTHING THERE!? - That sudden injection of adrenaline has got to shorten the operator's life span by at least an hour. Must be worth a few quid, surely?

[Juillen]

No languange massacre..

Nope, think he meant sensationalistic. I.e. the figure given wasn't meant to stir up the media. It was believed to be a realistic figure.

Given fines for not being able to produce those, cost to redo them if necessary, so on, so forth, 2.5m is not a very high figure for several years of commercial data.

[Hans Mustermann]

@ Stephen Jackson

Well, I can agree with what you wrote, generally. But here the advertised job was at another company.

I'm sorry, but I don't think every boss in a company has some duty to call a meeting and announce that his wife's small company is hiring a sysadmin. Heck, as an employee, I don't even want to know that kind of stuff.

And if anyone did, it would just look to a lot of people (myself included) like he's maybe trying to recruit from our company. Now that's a recipe for paranoia. I mean, does he know something we don't, if he's trying to transfer (only) some people to his wife's company? Is ours going under, or about to be sold, or what?

Finally, just to chime in the chorus, that still doesn't excuse such actions. Even seen strictly through the glasses of "employees rely on their job to feed their families and pay their rent"... guess what? So do her co-workers. Trying to get the company into trouble will affect those too, you know?

[Ash]

She tried too hard.

Any BOfH knows that a rubber mallet to the side of the HDD caddy is the way to go. Try recovering data when you've got a 1mm scratch across 60% of the platters from panel-beating the casing until the server drops a brick!

5 mins tops. 2 for Server 2003.

[Hans Mustermann]

Re: fake value

We don't have enough data to make that kind of a judgment.

E.g., I happen to know first hand that here in Germany (but probably in the UK and USA too) there's a _legal_ obligation to keep any business-relevant documents for a number of years. If anything on that server fell into that category, the company could easily end up paying that much just in fines.

We also don't know such details as what contracts they had with their clients. _If_ any contractual obligations required them to keep that data, breech of contract fines are again routinely measured in millions.

We also don't know how those related to their current business plans. I can imagine they would reuse some of that stuff in newer contracts. Either ending up having to hire more people to redo those from scratch, or ending up unable to finish a current project on time, _do_ cost money.

Basically just because you don't understand business and pulled numbers out of the rear end, it doesn't mean that everyone else is, you know?

[Anonymous Coward]

@A.J. Stiles

A.J.Stiles are you insane, why not just let a free programme like eraser do it for you. Press one button and go for lunch, job done.

[jim parker]

re Gordon

I thought Lindsay Anderson decided that 'if' had to be followed by four dots....

[alyn]

Don't shit on your IT staff

All employers should remember this. My last firm decided to outsource the IT dept. The fools gave us a weeks advance warning of what was about to happen. In that time I hid an account with full administrator priveledges. I never actually used it but their so-called IT experts never found it before I left.

[Pete]

heh heh, a better way to screw with the company

I wonder what the legal status would be if she hadn't deleted the files, just encrypted them?

The data's still there, so nothing's been stolen. Yo umight argue "criminal damage", but if she could demonstrate that when restored, they hadn't been damaged, woudl that argument hold up?

So long as she didn't ask for money for the encryption key, there's no extortion angle.

[Anonymous Coward]

Skills crisis.

4 Hours?!? Not only that, but the data was recoverable! This is why professionals are required in IT, and it must be why people keep talking about a skills crisis.

At one job I had when everybody was being made redundant around us I remember having a semi joking discussion about how much we could write off quickly when they came and told us we were redundant.

We would have needed no more than a few minutes to inflict quite serious damage, Hard drives and the backup tapes would have been floating down the river flowing just past the building to take care of the data, and to make things a little more interesting we could have taken wire cutters to the fiber cables delivering the isdn30, main net connection and the backup ADSL.

Oh, and pulling every cable out of the patch cabinet, and bottles of any random fizzy drink could have gone over the boards in the telephone switch and servers. At the most that would have taken 15 minutes with a good part of the time walking the drives to the river. I don't think anybody would get that system back up in operating condition very quickly.

But yeah. We did get made redundant and we didn't actually do any of it.

AC, because... erm, well. Yeah.

[Anonymous Coward]

@voshkin

I used to use a great little program called "Nap n Coffee", which faked a hard disk defrag and could lock out any use for the computer until it was done. Of course you could set it to last as long or as short as you liked... and nothing was changed on the computer... ideal for bumping up those 'consultant' fees.

[Anonymous Coward]

one word

women

[Mark]

Re: Value

It may have COST 2.5m to create the data, but once it's used, it's worthless. Well nearly.

I can drink £30,000 champagne. It cost that. But once I've drunk it, it's a weird person who'd pay £30,000 for the result...

[Anonymous Coward]

READ THE FRIKKING ARTICLE

The position advertised was for an ADMINISTRATIVE ASSISTANT. A glorified secretary. NOT for a Sysadmin. She probably just "deleted" the files, rendering them invisible, but not removed, and I will bet that she didnt know how to do anything else.

From the sound of it the office is small and probably doesnt have a system/network adminitrator, the boss probably fulfils that role.

Paris because that's what most of the comments above deserve.

[Kevin Gurney]

Backup.....

Who's to say that during those 4 hours, she wasn't creating her own personal set of backups for future use prior to the deletion of the data ?

Potential blackmail ????

[Alan]

What ever happened to innocent until proven guilty?

"Regardless of the firm's data backup policy, she was still a paranoid, disrespectful cow. I think you're all rather missng the point somewhat."

Presumably they have more evidence than "someone logged in using her username and password" because that sounds like the sort of evidence that any half competent lawyer would demolish in about ten minutes.

[sue]

@-@ AC:Date recovery By Anonymous Coward

Just jump down off your horse there for a mo, and give El Reg credit for being read by, and educational for, more than just speaky in a freaky computy way people.

Having said that, your post did offer handy information, so you're almost forgiven for assuming.

//A housewife.

[Anonymous Coward]

Outsourcing the admins

One account of ours outsourced their admin stuff to something like Geeks. The boss deleted all admin accounts upon escorting the admins out the door. Opps. Seems like the DNS server, backups, etc were all tied to those accounts, hence no backups. 6 days later the hardware (disk drives) crashed due to power loss. The company begged the former admins to "help us out", the new outsorce admins know nothing about the system setups. Former admins suddenly had a memory loss. It took the new outsource admins 2 weeks to figure some stuff out and eventually just simply created new servers. The real problem is now anytime you call to have anything done it's always a "we don't know" answer since the marketing company is just that now--marketing and no computer knowledge at all.

[Ishkandar]

@Oliver Jones

If she was good enough to re-design the frigging building, would she be an admin assistant ?? Go straight to CIA, Langley, do not pass "GO", do not collect your "Get out of Gitmo,free" card !!

Anyway, why is that nosy bitch snooping around looking into things that don't concern her ?? If she hadn't been snooping around, none of this will have happened; so any other details are moot !! No lawyer can get her out of that !!

[wiscados]

Permission

Why do you even give employees permission to delete 2.5mills worth of data?

Must've been using a windows server...

[Thomas Martin]

Good money

CNN said the man paid "good money" to get the data recovered. Undelete is such a good program . . . and cheaper than 2.5 million.

[Trevor]

Already Dissatisfied?

Anyone else note that she was looking through the help wanted ads?

[Mike Morgan]

Maybe she

would rather be in jail than on the street. Over here jobs are dear and the loss of a job can mean the end of a semi normal life. You know instead of a pay check you are looking for homeless shelters and hand outs. I live in a town of 56k and we have a 16 to 18% unemployment rate, people will kill to stay employed. Time are tough in George the younger's new Reich.

[Anonymous Coward]

I'm sorry, but...

I'm not hanging around here if people are going to use language like "defragmentate ".

Surely we must preserve some level of decency here?

[Robert Brockway]

Backups have nothing to do with computers

As usual when we say how they should have had backups someone responds with "they don't understand the technology" or similar. Backups have nothing to do with technology - they have to do with data retention. Believe it or not data existed before computers were invented.

European monks in the middle ages did backups of their important data. They had to do it the hard way by hand copying the documents but they still managed to do a very good job of backing up important data. We can thank their hard work copying documents for us having so many ancient documents available today.

[Philip Lord]

@sue

Hear hear Sue - well said.

I too read El Reg to try and educate myself in matters of IT. I'm also one of those poor sods that doesn't have a real clue about the big bad world of the interweb nor how this computer really works - and yes I have Windoze (XP thankfully) and Norton and yes I don't really know how to fully delete files other than through the Recycle Bin.

So, what I'm trying to say all of you at the back there sniggering and finger pointing at us sheeple at the front would do rather better from time to time to give us clue. Thank you.

[Anonymous Coward]

outsourcing foolishness

AC's outsourcing comments reminded me of when I worked for a large PC manufacturer that pulled that nasty little outsourcing trick. They then sent some secretary up to turn off all of the admin's secondary machines. Goodbye DNS, so long LDAP, nice knowing you, SMTP. They had to call 10 of the 12 admins before they could find one willing to tell them the machines they'd need to turn on . The ex-admin's memory was quite faulty, and enhancing his memory to the point where he could recall how to get them going wasn't cheap. I believe that the other admins did offer some instruction, but as their instructions all involved the use of vaseline, weren't all that technically helpful.

Can't say I felt sorry for them -- as we all used to say, "It wouldn't happen to a nicer guy".

If I were the admin, I'd probably told them to use dban as a system recovery tool -- "You now have 360gb for your data, sir." "360gb? That means that I now have double the space?" "No, 360gb total. You now have your system recovered to the point where it is ready for installing."

You can learn a lot from the BOFH.

[Anonymous Coward]

IT madness

I worked for a company that use three different temp agency for thier IT. No one followed the IT policy when came to stuff like computer naming convention. When some thing went wrong they blamed the other companies. Oh and they decided to go from NT 4.0 to windows 2003 over night. Turned on 5 PDC and exchange at the same time . The next day the network was lagging. Oh and to make things worse the used a script from the net to migrate the profiles. Some thing went wrong cause if you were hired after a certain date you didnt have permissions that you were suppose to.

[Hollerith]

revenge is sweet

I was remaindered from a job and a month after I was shown the door with minimun legal pay-off they contacted me to ask about specialist web stuff -- advice about what should they do about this and that, and oh, about that stuff in the stylesheet, what did that mean? (I kid you not.) But surely these questions meant I wasn't redundant? Well I believed them when they said I was, so I didn't bother replying.

But I also hadn't bothered wreaking any havoc, because I knew that a company who would get rid of its web manager without thinking they might need to replace with the same skillset was going to torpedo itself sooner of later, and indeed that was the case.

Any company who leaves itself open to the possibility of a junior admin person deleting anything outside her remit in a frenzy deserves to be hammered. And no company with a proper back-up process in place needs to pay any specialists.

Own goal.

[Scott]

$2.5 million

Could very well be a conservative estimate of the value of that data (depending on their contracts and the type of data they're storing).

I work as an admin for a small Civil Engineering firm, and in many respects our business is very similar to theirs. If our office lost 7 years of project files, we could easily amass much more than $2.5 million in fines and labor costs in recreating the files. This is why we have daily on and off site backups, and why our backup methodology (and even the existence of said backups) is not discussed with anyone other than top management.

However, I do have to wonder why she had access to do so much damage. It's generally not necessary for a secretary to have that much access to project files.

[N]

Architects & backups?

Got their heads way too far up their own arses to back up data. After all, thats someone else's job isn't it?

[tony trolle]

RE:What ever happened to innocent until proven guilty?

Her code disarmed the alarm, her account deleted the files but importantly Marie Cooley has confessed to the crime.

The charge is an second degree felony that can go up to a five-year prison sentence.

Of course this all started with the wife; who used her own phone number but her husband's office/business email account in her ad.

The thing that sticks in my mind is it took her four hours (according to the alarm records) to delete the files; could this be Vista ? or it that just copying files : )

[Adrian Esdaile]

Architects? No backups, for sure!

Trust me, I am an architect, but one of about 10 in Australia who actually do backups.

Architects are uniquely exposed to data loss; we rely on clunky, bug-ridden, over-marketed, under-developed, crappy software, which uses seriously massive but largely proprietory (and un-interchangeable) data formats.

Architects are also notorious misers (car space? holidays? overtime? what are they?) and rarely forkout for expensive luxuries like backup tapes. The directors can usually fork out for Saabs though, which shows just how bloody stupid they are. I mean, who in their right mind buys and drives a freakin' Saab?

The RAIA is always going on about how firms can vanish if they don't do backups - it's even worse for the few Mac-based firms, because they believe their Macs are infallible and certainly don't bother with backups.

A big firm I worked for did have backups, made regularly, but (crucially) not tested regularly. A leaky window seal and some heavy rain meant 2 weeks work was totally lost one afternoon - my own little team survived because I was making (highly unauthorised) backups to CDs of our work. I got told off in a really wierd way for that one!

I would say there is good money to be made providing backup solutions for architects - but there isn't. They won't pay up. They are all too busy trying to find where to put the keys in their Saabs.

[Gordon]

Weird...

Random thought is "What the h*eck is an admin assistant doing with the privilege level to delete critical data???". If we take her job title at face value, it seems odd that she's got the privilege to do this in the first place. This seems to indicate that this may not be a company for whom data security is a priority (odd, given it's apparent value!)

A simple journaling file system (or regular backup) to an offsite or secure onsite system would have been enough to have left the rampage as a mere annoyance, dealt with in minutes with no real drama. The fact that they needed to get someone external in to perform "recovery" suggests to me that we're talking about a recovery that involved more than toasting in some backup tapes and picking the data to restore...

Incidentally. Most IT folk at desktop analyst level or above could easily reprogram a door card as someone else, change someone elses password, and then delete critical files out-of-hours without being seen or leaving any clue as to their actions, unless captured on CCTV or seen by lobby security etc. Outside of IT staff - In most cases it would be childs play to bamboozle helpdesk operators into resetting someone elses password, and maybe "borrow" someone elses door card or fool facilities or security into issuing a replacement for a "lost" card. Unless they have CCTV of her deleting the data, or a signed confession from her, I don't see the evidence against the lady is at all conclusive.