Ask HN: Ex-Employer alleging me for hacking. What should I do?
Looking for some guidance here.
I was working in a startup for a few years. A few months back, we all received notices for salary cut since the startup was having some financial trouble. This didn’t change me much, but soon they started switching my role frequently, different languages and frameworks with vague requirements. I developed headache and soon I decided to leave them even if I didn’t have another job. I talked to my manager and told him that I’m leaving without serving notice period. I formally resigned and since then a few more devs left company. Unfortunately, at the same time, someone hacked their servers and I got a call asking for explanations. Others who left after me informed that they are still blaming me for this and some totally unrelated incidents.
So here is me, a fullstack jobless engineer knowing most of the cool languages as well as plain old things that work and getting blamed of hacking I never did.
What should I do and be careful of ? Sorry for lengthy text.
27 comments
[ 3.1 ms ] story [ 71.8 ms ] threadN.B. this will only apply to criminal prosecution. There is no requirement for the government to provide you with counsel for civil cases.
If it does come to that, and you can afford it, I would still suggest a private lawyer. Their win rates are usually better (not that public defender's are bad, I think they're just horribly underfunded and will struggle to give you the amount of their time that you need).
Privately document everything you did from the time things started going bad at the company. Be as detailed as possible, if you have any emails preserve them, but don't access any of their systems to do so. If they send you any communication trying to blame you get legal representation and give them everything you just documented. Do not make anything public, don't write blog posts about it, keep it professional and quiet. If they don't do the same then find an attorney to help you pursue them. Do not even visit their website.
I also wouldn't overreact initially, the reality is that companies going through troubles like this operate in chaos most of the time and are knee jerk reacting to many things at once so they are their own worst enemy and will hasten their own demise. Let them tie themselves in knots not you.
Outside of the above and as a general rule, don't interact with them or give them any information at this point, anything you say can be twisted into "facts" to trap you. You are better off keeping your mouth shut and just letting them spin. If they reach out blaming you the only thing I'd due is reply once something to the affect that "I left your employment and have had no access to any of your material, systems or IP since the day I left and only wish the company the best." You aren't giving them a defensive response, you aren't stating any detailed facts they can try and tweak to fit a narrative they want, you are simply stating you left and left all their materials there. Of course if this isn't true you should rethink the reply and likely just get an attorney, but just some basic advice. Also beware of any existing/former employees reaching out, even "friendly" where they ask you any questions or try to get you to detail anything.
caveat on all this: I'm not a lawyer and if you did something shady you need to approach this very differently.
On this sentence, just a clarification, give the attorney everything you just documented, not the company. Some poor sentence structure/grammer on my part, sorry.
They have accused you of a crime and if they have enough to convince a DA, you will have the government aiming for a conviction, along with all the resources they have.
That other colleagues have the perception that it was him, they have defamed him, entitling him to damages.
Today.
Now.
Get off HackerNews.
Call a lawyer.
Did I mention the lawyer part?
Call a lawyer.
Contact a lawyer, asap; if your colleagues are being led to believe this was you, this is defamation and may be affecting your ability to find new employment.
- Don't talk to the company at all. Don't explain anything. Don't say anything. The burden of proof is on them, not you. The more you talk, the more you are putting yourself at risk because the whole "Anything you say can be used against you" is really a thing. Even if you want to help them, don't.
- Being quiet is not an admission of guilt. Let them say whatever they want. Let them try to make you feel bad. You just don't respond with anything.
- Document everything you can in terms of your departure, timeline, what events occurred few weeks/days before your departure from the company. Write everything down. You may forget a few things later. Be specific.
- Stop talking to those other devs as well, at least about this issue. Better to not talk to them at all. Be very quiet.
Best case, the employer is just trying to find a scapegoat to blame for their own failures. They may move on if you don't fall for their blame game. Worst case, they are preparing legal action against you. In both cases, do not talk to them or anyone else about this issue except a lawyer who represents you.
EDIT: Btw, if anyone hasn't seen this video [0] at all, watch it. It is a great explanation by an attorney on why you should never talk to law enforcement without an attorney. Even if you are innocent and mean well.
[0]https://www.youtube.com/watch?v=d-7o9xYp7eE
Meanwhile, preserve and start collating every record you can, system logs, application logs, phone calls, pictures, locations, etc. Get every receipt. Try to reconstruct every bit of time you can. You don't know the date/time of their events, and if they are at times T1, T2, T3+++, and you can establish that you were out on a hike at T1, fueling your car at T2, and had shut off your computers at T3-20min, you start to establish your innocence.
And, of course cut off ALL contact with everyone there, and log every contact they attempt to make. Resist the temptation to defend yourself to them personally.
Good Luck!
The best bang-for-buck is to have a lawyer send the company a letter asking for all the concrete evidence of hacking, and reminding them of the relevant libel laws and what the consequences could be of spreading rumors. (Of course, they should hire a good lawyer and see what the lawyers suggests).
But assuming you are in the US, and they are potentially defaming you as individuals, then in my view deferring to an attorney puts everyone on edge and seals lips, whereas it seems very unlikely that an apparently failing company will expend dwindling resources and runway chasing a civil suit for an unemployed engineer.
Personally, I'd let them run their mouths and capture what you can. You could even try to be helpful by questioning what problems they're having and why they think it's you just to have them make further statements that either bolster a defence or give you ammunition for defamation proceedings should you wish to.
Don't fret too much (all assuming you've done nothing wrong). They're likely just stressed to the gills with a failing business in a pandemic so not acting rationally.
It sounds like your company is quite a piece of work, but if they are disorganized as you say at so many levels, it just sounds like them using you as a scapegoat. For a few months after someone leaves, everyone blames that person anyway - they can't fight back. That part is normal.