Prevention of information leaks

[Stevehewitt]

Hey people,

Just after some advice really as this has completly messed things up!

The sales manager left the company yesterday and is planning to go solo and is actually going to be a competitor of ours.

Well the problem is that he has created an AOL email account and has sent off some of the most confidential information we have such as customer lists, contracts and even our current stock and cost price.
I obviously cannot get this information back as it has passed through my network, but I was wondering if anyone knows of how to prevent this thing from happening again - or how the law lays it out!?

Thanks,

Steve.

 

[skiflyer]

Doesn't work with NTFS... think more along the lines of built in, multi level PGP (the way it's integrated into email clients, not the underlying technology.)

You'd have a site server maintaining the permissions over the documents. A user could take the file and give to CNN, no matter, without the site server and the proper credentials, there's nothing there for them to read.

It would just encrypt your file, but instead of a simple display don't display you could do things like..

don't display
disallow screen captures
disable printing

and set this however you choose for several different groups/individuals...

What it leaves me asking is, what about my 3 hour flight when I want to do some work?

-Rob

 

[gringomike]

Hi,

Sorry to throw a spanner in the works so late on but I have to pick up on this point made by manarth earlier on......

"Non-competition contracts mean squat here (thanks to the Human Rights Act - Freedom to work, etc...) but taking your company data will be seen in UK law as theft, plus a contravention of the Data Protection Act to boot."

Firstly there is no such thing as "UK" law. Scots law for example is entirely seperate from the law of England and Wales and, strange as it may seem, in Scotland the Sales Manager cannot be convicted of "stealing" the company data. If he'd printed a copy of it out onto paper he could be found guilty of stealing the paper but not the data itself. (It's classed as "incorporeal" - i.e. it cannot be touched and therefore cannot be stolen....)

He can be guilty of misuse of company property or of breaching a confidentiality agreement or the data protection act but criminal proceedings cannot be brought against him for being in possession of the data concerned.

Of course this could be irrelevant if you don't live in Scotland but it's important to understand that there are significant differences in the law within the countries which make up the "UK".

GM

 

[Stevehewitt]

That is the most stupid law I think I have ever heard. You can't touch it therefore its not possible to steal it?!
Wonder what MS would say about that when you are sending copies of Windows 2003 Server to everyone you know with broadband on a P2P System based in Scotland. Oh well - It cannot be touched therefore cannot be illegal to copy it!!!!!

What balls!

Steve.

P.S. No offence to the scots intended!

 

[gringomike]

Hi,

The law still protects copyrights. You wouldn't get away with sending copies of software around or freely distributing anything which was licensed electronically.

Anyway, I don't want to go off on a tangent, it might have been relevant if you were in Scotland but, since your not, it's immaterial!!!

GM

 

[Stevehewitt]

;-)

 

[Pyg]

Get your lawyer like everyone suggested and then think about installing Iris Network Analyzer to catch future offenses.

http://www.eeye.com/html/Products/Iris/index.html

It's expensive but it's nothing compared to the cost of having your customer list slip out the door.

With this prog you can set it up to red flag keywords and attachments.

Good luck.