Possible SOX non-compliance with fortune 100 Pharma company

tankman1989

Active Member
Reaction score
5
About a year or so ago, while working for Dell, I ran into a very unsettling situation. I was part of a new system roll out of about 400 desktops and laptops at the companies headquarters. The first thing that was odd was that these computers were less than two years old and they were being replaced. I just thought they had cash to burn or something.

A couple days into the roll out, I asked the two company IT employees who were in charge of the project what they were doing about the information on the old computers. They told me that they had it taken care of. It was not listed on our work order as something we needed to do but no one at the company knew where the old computers were going, except to be resold.

Towards the end of the project, I had to transfer the files from the CEO and the CFO's computer to their new machines. While doing this I said to myself "self, you could probably find some very good insider information here and make some good money in the stock market. Self, that would just be a bad idea and probably lead to bad things. Self, just keep working".

I transferred these two computers and carried them downstairs to the IT office and then asked again if they had some type of security measure to ensure that the information on the HD's wouldn't be passed on to the next user. I had been dealing with some very serious computers like their R&D PC's, Sales, Accounting, Finance, etc (not to mention the CEO and CFO). When I asked this I got the cold shoulder from one woman and a look like the other woman had just seen a ghost. I figured that she just hadn't prepared for the "shredding" or zeroing of the HD's.

I felt that something was wrong and I called a couple friends and my dad and asked if I should mention this to someone else in the company.

The next day I was working in an accounting office and the person was actually at his desk. This was one of the first people I had seen working at the computer while I was doing the roll out, which was odd. I asked him if there was anything sensitive on his machine that might be bad if it were to get in the hands of someone outside the company. He looked at me like I was out of my mind and said ABSOLUTELY! He had all their customers banking and credit account info, all employee payroll/banking info (they store both on server and on desktop for some reason), and a lot more. He called in his manager and I told her what was going on and she flipped out. I was like, great, I'm in trouble.

This woman, the manager of the accounting department, said that these computers must not leave the building, under any circumstance, without the hard drives being totally cleaned. I told her this was out of my hands and she would have to talk to their IT dept. She gave me her card, number and personal number and told me to keep her updated and let her know what happens.

Later that day, I was asked by the IT lady if there was software available that would wipe the drives and how it could be used. She asked me if I could bring in a disc to do it. I told her that I couldn't do that. She was VERY flustered and seemed to be having a nervous breakdown.

I knew a girl in the sales dept at the company and called her up and got her to give me the CEO's extension, as it was my last day at the job. I never called him but I did call the woman in accounting and told her that the machines were being packed up to be shipped to the Dell facility which resells the machines. I actually took all the information about the shipping address, packaging list and invoice at the time because it just didn't feel right.

As I was leaving I was told that I was to show up the next day for 4 hours to fulfill the contractual obligation which ensured that someone would be on site to make sure the new machines were working ok. I showed up and after about 45 mins I was told that I could go home (by the pharma IT people). At that point, the machines were packaged up on a pallet getting ready to be shipped back to Dell, complete with the old HD's in them.

After this job I was never contacted by Dell again to do work, which was strange because I was their strongest worker. Also, the woman in the accounting dept never returned any of my phone calls when she was so adamant about knowing what happened to the data on the hard drives.
Now maybe I shouldn't have asked about the data on the hard drives but it started out as a question if WE were doing anything with them so they could store them on site, and from there it escalated.

This whole process was so strange that I typed up a report at home to figure out if I had done something wrong.

Does this sound fishy to anyone?
 
This also breaks SOX Compliance as all pubically traded companies MUST comply by those rules - part of which includes the storing of ALL hard drives (working or not) for at least 10 years.

I don't think that's accurate. Do you have a source for that?

I have a contract with a VERY publicly traded company. We are not required to keep Hard Drives and they are destroyed during monthly e-waste disposal. Data retention time varies depending on the type of information. Anywhere from 3 years to permanently. But that is just this particular division

SOX compliance can vary based on data type, industry type, and secondary laws. So while a specific company may require keeping hard drives for 10 years, it's not a blanket rule.
 
Does this sound fishy to anyone?

You were right to be concerned but I do think you got more involved than was prudent. After making the IT department aware of the data security concerns and not seeing anything done about it I probably would have dropped it. Chances are good that the IT employees didn't get in any real trouble for what they did and it sounds like you lost future contract work from Dell for your efforts. Unfortunately I think a lot of companies don't take data security seriously until they get burned.

I'm actually curious how you get setup to do work for Dell. I know Dell contracts with 3rd party businesses but I've never really thought about the exact relationship between Dell and the business. I've got a tech coming out tomorrow to work on some laptops, maybe I'll ask him.
 
Back
Top