Why did this happen? How can we prevent it from happening in the future? These are the questions we need to stress.

In particular, why does an ex-employee still have access to production? I say when something like this happens and heads must roll, they must roll at the top. Fire the CEO. Fire the board. Leave the sysadmin alone.

This is a civil matter. My tax dollars should not pay for a criminal lawsuit. Screw that.

Oh and by the way if you're reading this: please help repeal cfaa.

Put another way, someone at Verelox screwed up and left the door unlocked, but that doesn't mean that the person who walked in broke stuff is in the clear.

Look, someone, without authorization, accessed a former employer's network and maliciously destroyed data. That's a crime. Sure, the CFAA is overly broad and is abused, but this is not one of those cases: this is a textbook example of something that should be prosecuted under the CFAA.

We should not equivocate on cfaa. It is good for nothing. Full and unconditional repeal should be our only demand.

Nope. The affected customers probably have grounds for a civil suit, but no sane prosecutor would think bringing criminal proceedings against Verelox to make sense at all.

The ex-employee who perpetrated this is at fault as well and must bear responsibility for his destructive actions. Having the ability to do something (even due to a lapse in security) does not make that action moral or legal.

We may remain open to additional information without presuming that uncivil and illegal vandalism was justified indeed without inventing a narrative from whole cloth as you have done. The logical conclusion is that drawing from your own life experience you identify so strongly with the narrative of the wronged sysadmin that you desire to fit a narrative to sparse facts that has no basis in fact.

We are merely commenting on a story on hacker news. We aren't members of the jury and don't face the same burden or power. I'm down with repealing the cfaa because its badly written, I'm down with figuring out who dropped the ball as far as giving the sysadmin access post firing, but as to the sysadmin himself, burn the witch!

IIRC, the Soviet Union had a policy rather like this, referred to as something like the Vertical Stroke, where anytime there was a screw-up at a low level, they would fire the screw-up-ee's manager, and manager's manager, and so on, up to a very high level. The practical result was a drastic decrease in innovation and risk-taking. CEOs and others at that level usually aren't close enough to the guys actually doing direct work to supervise them all closely enough to ensure they don't make mistakes. All they can do is create a culture where there's a book of rules, and you don't deviate from the rules ever, for any reason, no matter what. So that's what they do, and that's the resulting culture and economy that you get.

Maybe we shouldn't rush to judge either sysadmins or CEOs, but instead figure out who, if anyone, actually did something malicious, and let everyone else take the lessons they've already learned from what happened.

They can't have it both ways.

If he did it (intentionally wiping the servers), then he is a criminal and a bad person.

If he is a scapegoat, then he didn't do it, so that's a totally different situation.

I don't see how you can disagree with either of these statements.

And discussion of how he still had access is an unrelated matter.

Maybe he became an ex-employee after (and as a result of) wiping production.

I've heard stories where employees wiped production by accident and promptly became ex-employees, followed by their ex-employer trying to put all blame on them. We don't have enough information at this time to determine whether this is what happened at Verelox.

So if an aggrieved ex employee does enough damage that the company has insufficient resources to sue, or has enough resources themselves to make that difficult, it's all good?

Individuals and companies should not be vulnerable to attacks like this based on their resources. It's in all our interests to ensure this sort if activity is dealt with severely because we are all vulnerable. Mutual defence in the form of criminal prosecution of offenders is the way they go IMHO.

Let's be practical. What is our end goal? Is it vengeance or is it prevention? If it is the latter, our actions must not be centered on retribution but rather on logic and reasoning. We should ask what can we do to prevent this from happening again? Throwing someone in prison is not the answer IMO.

http://www.telegraph.co.uk/news/uknews/crime/12090890/Reveal...

What do you expect me to do? Investigate the matter myself? Buy myself an unlicensed firearm and look for the hacker to get it back at gunpoint?

That the actions described in the claims are criminal is not in doubt. Whether those actions actually took place is unproven, as is whether this unnamed ex-administrator performed those actions.

So, I'm not ready to say that this person is a criminal, or that a crime was committed, but I am ready to say that the actions described in the claim are criminal and wrong.

Finally, all of that is applicable to the courts & government determining criminal acts. The courts don't determine what is moral or ethical. Lots of things are wrong that aren't criminal. Saying something particular behaviour wrong really doesn't have anything to do "innocent until proven guilty".

Saying that, "if someone did what the story said they did, it's wrong" is really not saying anyone is guilty of anything.

How many little shops rely on Verelox - aren't they little guys?

How many end customers depend on services that depend on Verelox - you know someone like you - aren't they the little guys?

The police/prosecuting agency in the country where the company is based I imagine. That appears to be Holland [1]

[1] https://www.ripe.net/membership/indices/data/us.verelox.html

The fact that it was an ex-administrator does suggest foul play as opposed to a mistake compounded with poor backup processes. We shall have to see how the story pans out.

Sigh. I can't believe we're going there on this one. Just so we're clear, you think that maybe the definition of criminal behaviour shouldn't include wiping out systems without the owner's consent?

> And why is criminal behaviour always placed on the little guy when companies can always get the leeway of claiming ignorance?

I don't know what you are talking about. Criminal behaviour is placed on the criminal... and ignorance of the law is not a defense.

We do.