As one of those old hackers whose past hasn't been a problem...

I think that basically what these companies are thinking is: liability.

If one of their employees does something questionable while logged

onto a client's systems, can they claim they had no idea their loyal

worker would ever do such a thing? Most likely, *unless* the courts

have already determined otherwise with a conviction. That's pretty

hard to cover up, ignore, or explain away.

Is this fair? No, not at all. But the injustice starts way before that, with

some people not being caught, others getting probation for minor

charges, and yet others doing long prison terms and having ridiculous

restrictions put on them. The employability issues are just a little icing

on the cake.

Smart employers might want to consider how to use the skills of

convicted hackers in contexts which do not put them at risk. Just

because getting root has been one of their stronger points in the

past doesn't mean that the only thing they can do is unsupervised

penetration testing.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/79/3220#3220