Ask HN: Ex-Employer alleging me for hacking. What should I do?

[throwaway547]

Looking for some guidance here. I was working in a startup for a few years. A few months back, we all received notices for salary cut since the startup was having some financial trouble. This didn’t change me much, but soon they started switching my role frequently, different languages and frameworks with vague requirements. I developed headache and soon I decided to leave them even if I didn’t have another job. I talked to my manager and told him that I’m leaving without serving notice period. I formally resigned and since then a few more devs left company. Unfortunately, at the same time, someone hacked their servers and I got a call asking for explanations. Others who left after me informed that they are still blaming me for this and some totally unrelated incidents. So here is me, a fullstack jobless engineer knowing most of the cool languages as well as plain old things that work and getting blamed of hacking I never did. What should I do and be careful of ? Sorry for lengthy text.

[codegeek]

Yes talking to a lawyer is a good idea but while you do that, make sure you are also doing a few things:

- Don't talk to the company at all. Don't explain anything. Don't say anything. The burden of proof is on them, not you. The more you talk, the more you are putting yourself at risk because the whole "Anything you say can be used against you" is really a thing. Even if you want to help them, don't.

- Being quiet is not an admission of guilt. Let them say whatever they want. Let them try to make you feel bad. You just don't respond with anything.

- Document everything you can in terms of your departure, timeline, what events occurred few weeks/days before your departure from the company. Write everything down. You may forget a few things later. Be specific.

- Stop talking to those other devs as well, at least about this issue. Better to not talk to them at all. Be very quiet.

Best case, the employer is just trying to find a scapegoat to blame for their own failures. They may move on if you don't fall for their blame game. Worst case, they are preparing legal action against you. In both cases, do not talk to them or anyone else about this issue except a lawyer who represents you.

EDIT: Btw, if anyone hasn't seen this video [0] at all, watch it. It is a great explanation by an attorney on why you should never talk to law enforcement without an attorney. Even if you are innocent and mean well.

[0]https://www.youtube.com/watch?v=d-7o9xYp7eE

[toss1 → codegeek]

Yes, get an atty, (and I am not one), and make sure they are a really good one, specializing in your type of case (not just a random general practicioner. Get recommendations from the best attny's you can contact in your network.

Meanwhile, preserve and start collating every record you can, system logs, application logs, phone calls, pictures, locations, etc. Get every receipt. Try to reconstruct every bit of time you can. You don't know the date/time of their events, and if they are at times T1, T2, T3+++, and you can establish that you were out on a hike at T1, fueling your car at T2, and had shut off your computers at T3-20min, you start to establish your innocence.

And, of course cut off ALL contact with everyone there, and log every contact they attempt to make. Resist the temptation to defend yourself to them personally.

Good Luck!

[shakkhar → codegeek]

I think OP could (should?) also sue the company for harassment and defamation if the ex-employer is badmouthing him around town which could have real career impact.

[lostdog → shakkhar]

It's probably hard to win a case without concrete evidence that the badmouthing is happening and hurting their future job prospects.

The best bang-for-buck is to have a lawyer send the company a letter asking for all the concrete evidence of hacking, and reminding them of the relevant libel laws and what the consequences could be of spreading rumors. (Of course, they should hire a good lawyer and see what the lawyers suggests).

[sitkack]

Hire a lawyer asap. And as another poster mentioned, talk to no one w/o a lawyer present. Period.

They have accused you of a crime and if they have enough to convince a DA, you will have the government aiming for a conviction, along with all the resources they have.

[smileysteve → sitkack]

To upvote, not only have the accused him of a crime;

That other colleagues have the perception that it was him, they have defamed him, entitling him to damages.

[davismwfl]

I assume you have done nothing wrong here given how you wrote this, if you crossed any lines my advice would be different and I'd advise you to get legal representation immediately.

Privately document everything you did from the time things started going bad at the company. Be as detailed as possible, if you have any emails preserve them, but don't access any of their systems to do so. If they send you any communication trying to blame you get legal representation and give them everything you just documented. Do not make anything public, don't write blog posts about it, keep it professional and quiet. If they don't do the same then find an attorney to help you pursue them. Do not even visit their website.

I also wouldn't overreact initially, the reality is that companies going through troubles like this operate in chaos most of the time and are knee jerk reacting to many things at once so they are their own worst enemy and will hasten their own demise. Let them tie themselves in knots not you.

Outside of the above and as a general rule, don't interact with them or give them any information at this point, anything you say can be twisted into "facts" to trap you. You are better off keeping your mouth shut and just letting them spin. If they reach out blaming you the only thing I'd due is reply once something to the affect that "I left your employment and have had no access to any of your material, systems or IP since the day I left and only wish the company the best." You aren't giving them a defensive response, you aren't stating any detailed facts they can try and tweak to fit a narrative they want, you are simply stating you left and left all their materials there. Of course if this isn't true you should rethink the reply and likely just get an attorney, but just some basic advice. Also beware of any existing/former employees reaching out, even "friendly" where they ask you any questions or try to get you to detail anything.

caveat on all this: I'm not a lawyer and if you did something shady you need to approach this very differently.

[davismwfl → davismwfl]

> If they send you any communication trying to blame you get legal representation and give them everything you just documented.

On this sentence, just a clarification, give the attorney everything you just documented, not the company. Some poor sentence structure/grammer on my part, sorry.

[LinuxBender]

Disclaimer: I am not a lawyer. Defer all communications to a lawyer. If you can not afford one, then get a public defender if they attempt to prosecute you. It is on them to show logs that prove their accusations. Do not assume they have evidence. You could easily fumble your way into being a scapegoat for someone else if you talk to anyone other than a lawyer.

[curryst → LinuxBender]

> If you can not afford one, then get a public defender if they attempt to prosecute you.

N.B. this will only apply to criminal prosecution. There is no requirement for the government to provide you with counsel for civil cases.

If it does come to that, and you can afford it, I would still suggest a private lawyer. Their win rates are usually better (not that public defender's are bad, I think they're just horribly underfunded and will struggle to give you the amount of their time that you need).

[LinuxBender → curryst]

Agreed, public defenders should be a last resort. Criminal and/or civil will depend on what specifically they are being accused of. There are criminal laws pertaining to hacking and unauthorized access.

[throwaway547 → LinuxBender]

Thanks, will surely keep this in mind.

[smileysteve]

> Others who left after me informed that they are still blaming me for this and some totally unrelated incidents.

Contact a lawyer, asap; if your colleagues are being led to believe this was you, this is defamation and may be affecting your ability to find new employment.

[throwaway547]

Thanks for some really good insights. My country isn’t quite good for law enforcements if this helps. As almost all of you pointed, I’ll surely be in contact with a lawyer for advice. I hope this is their frustration and nothing big. This is a lesson to me and I’ll try alternatives like some freelance, building my own stuff and getting back to open source etc. Thanks again, you guys are awesome.

[cbanek]

They might blame you but that doesn't mean they have any proof that you did anything. If they did, they would likely have already told you, and you'd be arrested. But for sure, don't say anything to anyone at that company anymore, retain a lawyer, and go through all the details with them. If you aren't terribly worried, you could always get a lawyer when you need to (if charges arise, or if you are sued, which I honestly doubt). It doesn't sound like the lawyer will be able to do anything unless they do something first, so I don't see any big reason to jump the gun. Don't try to sue them or take any action against them, that's too high risk for the same reasons.

It sounds like your company is quite a piece of work, but if they are disorganized as you say at so many levels, it just sounds like them using you as a scapegoat. For a few months after someone leaves, everyone blames that person anyway - they can't fight back. That part is normal.

[Hallucinaut]

Contrarian here. Lots of people saying lawyer up. I would first just like to say that's on the assumption you're in the USA; plenty of jurisdictions that would be an over reaction.

But assuming you are in the US, and they are potentially defaming you as individuals, then in my view deferring to an attorney puts everyone on edge and seals lips, whereas it seems very unlikely that an apparently failing company will expend dwindling resources and runway chasing a civil suit for an unemployed engineer.

Personally, I'd let them run their mouths and capture what you can. You could even try to be helpful by questioning what problems they're having and why they think it's you just to have them make further statements that either bolster a defence or give you ammunition for defamation proceedings should you wish to.

Don't fret too much (all assuming you've done nothing wrong). They're likely just stressed to the gills with a failing business in a pandemic so not acting rationally.

[wikibob]

Call a lawyer.

Today.

Now.

Get off HackerNews.

Call a lawyer.

Did I mention the lawyer part?

[gota → wikibob]

Seriously. What does it take to call a lawyer if not _being accused of a crime_? Particularly one that affects your capacity of getting a job and therefore your livelihood and future?

Call a lawyer.

[valdiorn → gota]

Hundreds of dollars? And he did just say he's unemployed. Not everyone has enough cash around to even pay for a consultation.

[ehutch79 → valdiorn]

I'd chip in $10 for him to get a lawyer

[Bjartr]

This is worth repeating: speak with a lawyer

[exabrial]

Don't post anything else online. Get a lawyer and keep your lips sealed

[o-__-o]

Do not talk to the company, anyone at the company, or the police if they come to you. If law enforcement shows up at your door, refuse to talk without a lawyer present. You are under NO obligation to callback the police if they do call or attempt to contact you.. if they really want to talk to you they have the power to arrest you. It may be a good idea to start a conversation with a lawyer now to CYA.

[frompdx]

It's time to speak to an attorney.

[simplestman]

Just to give a different perspective, it is unlikely they will do anything. You may talk to a lawyer but I would not stress too much about it.

[meh2frdf]

failing start up looking for someone to pin their failures on, I’m guessing they got hacked in some trivial way ... I’d resolve it by giving the twat who is taking crap a slap ... or you could do the lawyer thing, sounds more American.

[suyash]

counter sue