Community archive

Ask something
Discussion Locked

Interact with the DR e-newsletter

0 helpful
10 replies

by editor's response

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Take a look at the scenario below and offer your best solution. The most innovative answers will be noted in the Disaster Recovery e-newsletter on Feb. 25, 2003, along with Mike Talon's advice on this particular topic.

I've just walked into your senior staff meeting and held up a 2 GB thumb drive. On it, I claim to have your CEO's entire mailbox--every single message. If you don't pay me $2 million in U.S. currency, I'll release the entire unedited mailbox to the media.

Of course, you could try to stop me from leaving, but I've taken the precaution of mailing a copy of this device to someone who will send it to the media in my absence, so I wouldn't do that if I were you.

In short, I'm in the process of perpetrating a disaster onyour firm, and it's technology related at that.

What would you do in this situation? Don't worry about going into great detail--the point here is to discuss the initial response and first steps of a nonserver-related disaster.

If you haven't subscribed to our free DR e-newsletter, be sure to do so today!

https://www.techrepublic.com/techmails.jhtml?repID=r001

10 replies

by yoshininja

Tell him that you will give him the money, but it will take 24 hours to secure the funds.
Arrange some meeting place for tomorrow, and send him on his way. As soon as he leaves, call the police and press Blackmail, Extorsion, Theft, and what ever other charges your lawyer can suggest...
Later, at your meeting place, have the cops waiting for him, or have the money tagged so you can find out where he is going.
Hey, it works in the movies :-)

by military tech

First, have Security outside the boardroom and do not let him leave. These individuals think that you will not arrest them, and they really do not want to go to jail. By having security outside the boardroom, you have time to discuss your options.
Second, have the IT department shut down the firewall and Internet access immediately, including all RAS connections that bypass the firewall, ALL of them (even the ones in executive territory).
Third, disconnect the mail server from the network immediately, and find the reason that this individual got access to the mailboxes in the first place. Find the hole and then patch it, software, hardware or physical security as necessary. Prevent this from happening again.
As I said, this is officially a criminal now. Even if he is joking, he perpetrated a criminal act. He should be treated as such, but the consequences must be weighed by management. I would vote for crisis management, but throw him in jail. If management decided to acquiesce to his demands in some way or fully, I would support them, as they own/run the company. Closing the door is a must, though!

by ken gray

Don't let him leave. Contact the FBI. It will not be hard to locate his accomplice (via electronic footprints and just plain shoe leather). Now, as far as the emails getting out, well, let's hope the ceo wasn't as stupid as this guy. The criminal wants money not prison. If anything particularly embarrassing gets out, "confirm" that after review, the thief mixed "fake" emails in with the real ones in order to cause more pr damage to the company. And that due to the FBI investigation, the company cannot comment on any emails that did make it out.

After all that is said and done, pay anyone within the company $500 if they can tell you any of the ceo's passwords (take each of the $500 checks out of the ceo's next paycheck).

by gsg

Tackle him, wrestle him to the ground, and call the FBI. It won't be hard to find his buddy... He'll sing like a bird and tell everything he knows to get a lighter sentence. Meanwhile, take a look at the disk on a quarantined system (the disk maybe "booby trapped") and see exactly what is on it.

Even if confidential data gets released, the company is better off to not pay up. The info will get released anyway, and the company becomes a target for all the hackers out there.

by deuces

I'd just beat the living $#!+ out of him.

Will that accomplish anything. No, but it sure would make me feel better.

by mallardtooxx

Force feed him windex until he is about to pass out. Then sick your rottweilers on him and laugh sinisterly. he will spill his guts to get the rotts off of him, you then go find his buddie and do the same. If you're lucky he will squeek as the rotties are tearing him up, and all the windex wil make cleanup a breeze!

as a side bar... if you ring your hands while you are laughing sinisterly that just adds to the dramatic effect of the whole scenerio.

-duck

by miketalonnyc

Ok, in retrospect I shouldn't have used myself as the example. Please remember this is just an exercise, and I'm locking my doors just to be safe =)

Keep up the suggestions, so far one of you has actually gotten VERY close to my reccomendations - tune in next Tuesday to see the results!

Mike Talon

by industrial_controller

First of all, if he is a blackmailer, he is probably also a liar. Make him prove he has the emails on that drive. If he does, you won't necessarily be able to contain the damage by paying money. Prosecute in any case. Then review and update all of your corporate rules regarding emails and toughen your security. Maybe you just dodged a bullet. Next time....

by mitch

Tell bad boy that we can't just release those funds. Say that this is a board-level decision, and they must be involved. We'll call an emergency meeting, come back tomorrow afternoon, or as much time as you can get; you'll need every minute. Oh, and by the way, give us proof that you have what you say you have, we need it to convince the board that this threat is real.

Then:

Verify that the threat is real. If not, send bad boy a letter by courier that his services are no longer needed.

If bad boy has the goods, continue:

Call the manager of corporate relations, corporate legal counsel and the boss into a meeting. Determine worst case, what happens if this gets out. PR should be able to counter anything that comes out, and legal should be able to position itself to counter any problems in that arena.

Now, you're prepared to act. Bad boy has committed a few felonies, so legal needs to contact the local District Attorney, as well as prepare the beginning of severalcivil legal actions against him.

When bad boy returns, he should meet with you in an office with full audio and video taping courtesy of local law enforcement. Hand him his check, and let the officers take him.

Begin the damage control by contacting the parties likely to be aggreived by release of the information. Corp. relations, and legal should be able to handle this. If cash renumeration to them is required, pay with a smile.

Now:

Secure your e-mail and review ALL IS security. get outside help, since your failure is partially to blame here.

Have a talk with the boss, and tell him why the 'e' in e-mail really stands for evidence.

by philmur

I would first assume that all that you have copied is the mailbox data from the email application. I would ask the CEO if he used a password to access his email and how long was it, 6 or more characters with a number in it would be good. If he diduse a password then the data on the drive could not be accessed unless you could break the password.
Next I would ask the CEO if the email policy covered the deletion of old out dated emails.
If the email system is regularly purged then any old information should not be present on the drive. Finally I would question the IS/IT personnel about access to the clients computer and/or to the server handling the application.

This discussion is closed to new replies.