Security Basics: Re: Corporate policy question - Personal Laptops

[Ansgar Wiechers <bugtraq () planetcobalt net>]

On 2008-09-11 Tom Yarrish wrote:
> Needed some advice on a corporate policy issue.  If an employee has a
> personal laptop in the office, and that employee is terminated in the
> process of a merger, can the company wipe the hard drive of the
> personal computer before it's returned to that employee? Here's the
> scenario:
>
> Our company is going through a merger, and through the rounds of
> "integration" of the two companies, employees that are let go from the
> IT department are escorted out of the building immediately, and not
> allowed to return. Their manager packs up their personal affects and
> ships it to them.  In one case, the employee had some personal laptops
> in their office, and wants them back (obviously).  Are we allowed to
> wipe the hard drive of that personal laptop before giving it back to
> the employee?
Without the employee's agreement: no. Since it's not company property
the company can't even touch it. That's one of the reasons why you
usually don't allow private computers in the office.

Regards
Ansgar Wiechers
-- 
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq