Computer tech deleted for ‘malicious’ software

Spy program found on office computer after tech fixed it

This instalment of You Make the Call features a technical support employee who was fired after security concerns for the computer network were raised.

Lindsay McIvor, 49, was a computer technician for the Sandy Bay Ojibway First Nation, a First Nations community near Marius, Man. McIvor was dismissed in April 2008 due to funding cuts. In November of the same year, he was recalled. Before McIvor was recalled, the receptionist for the community office had difficulty logging on to her computer, so she called McIvor for help, even though he was not officially employed at the time. Her computer had all of the band’s administration files and access to financial information and was connected through a network to the band’s other computers.

Three years later, in the summer of 2011, the receptionist’s computer became slow in working. Another technician was summoned to check it out and discovered a software program called Cain and Able had been installed on the computer. Cain and Able was a program that could be downloaded for free off the Internet and could be used to recover encrypted passwords. This software could be used by hackers to collect passwords and program keys to recover information from a computer.

In addition to the software, a key logger program had also been installed on the receptionist’s computer. In order to install the programs, the computer’s anti-virus software would have had to have been disabled.

An investigation determined that several programs on the network had been accessed recently and the key logger software had also been recently used. The technician recalled when he worked with McIvor a few years earlier and that McIvor had mentioned he had some software on a flash drive, called Cain and Able, which could be used to crack computers. The technician reported it to his supervisor but nothing was done.

The technician reported the “malicious software package” to the chief and band council. The council determined the band’s finance and administration information had been compromised. The investigating technician, McIvor, and one other person were the only people in the community who had the knowledge to install such programs, and it was determined McIvor was responsible. McIvor admitted he used the Cain and Able software to retrieve the receptionist’s password in 2008, but uninstalled it after he used it. He couldn’t explain why it would be active in 2011. He also claimed the receptionist’s computer wasn’t connected to the network in 2008 when he installed the software. McIvor was terminated on July 12, 2011 for breach of confidence and to ensure the security of the computer system.

You Make the Call

Did the Sandy Bay band have just cause to dismiss McIvor?

OR

Was there insufficient cause to dismiss him?

If you said there was insufficient cause for dismissal, you’re right. The arbitrator found there was insufficient evidence to prove McIvor was responsible for the malicious software. The computer was in an open reception area accessible to the public and as many as five different people had access to her password when she was away. In addition, the company that installed the computers also would have had access, said the arbitrator.

Given the serious consequences McIvor suffered due to the termination — limited employment opportunities and damage to his reputation — the arbitrator found the standard of proof for just cause must be high to warrant it.

“I am of the opinion that there are other possible or probable explanations, and that I have sufficient doubt as to whether the employer has satisfied the onus of providing clear, cogent and convincing evidence that (McIvor) is responsible for the actions alleged,” said the arbitrator.

The arbitrator found the band didn’t meet the standards to justify McIvor’s termination. The band was ordered to reinstate him, though without retroactive compensation because he didn’t make any efforts to mitigate his losses by looking for other work. See Sandy Bay Ojibway First Nation and MGEU, Re, 2012 CarswellMan 505 (Man. Arb.).

Latest stories