Privacy, Licensing and Policy

What it is

A technician sees private data and often finds problems that are not technical, such as illegal files or rule breaking. This topic covers how to respond when that happens, how to protect personal and regulated data, and how software licences work. The common thread is to follow policy, protect evidence and avoid doing more than the job requires.

How it works

Prohibited content and activity

If you find illegal or policy violating content, such as illegal images or signs of fraud, do not delete it, share it or investigate on your own. The steps are as follows.

1. Identify what you found, and stop looking further than needed.
2. Report it through the proper channel, such as your manager, security team or legal contact.
3. Preserve the data and device as they are.
4. Document what you saw, with times, in a factual way.

Incident response and chain of custody

The first responder's task is to secure the scene and report. Do not turn off or change the device unless told, and keep it under your control.

Chain of custody is a record of everyone who handled the evidence, when and why. A break in the chain can make evidence unusable.

Data preservation may mean making a forensic copy of storage and keeping the original sealed. Label and log each item.

Order of volatility

When collecting evidence, capture the most short lived data first, because it is lost when the device loses power.

1. CPU registers and cache
2. Memory (RAM), including running processes and network connections
3. Swap file and temporary files
4. Disk contents
5. Remote logs and monitoring data
6. Backups and archived media

Regulated and personal data

Laws and standards set how such data must be stored, shared and destroyed. Examples are GDPR (General Data Protection Regulation) in the European Union and HIPAA (Health Insurance Portability and Accountability Act) in the United States. The details vary by country and sector, so follow company policy and ask the compliance team when unsure.

Treat customer data with care. Do not read private files that are not needed for the repair, do not copy data without permission, and lock the screen when away.

Data retention rules say how long records must be kept, such as financial or health records, and when they must be deleted. Retention comes from law and company policy, and expired data should be disposed of securely.

Software licensing

Using unlicensed or pirated software breaks the law and can bring malware. A technician should not install software without a valid licence.

Personal licences generally do not cover business use. Open source licences still have conditions, so read them.

A perpetual licence is bought once and can be used indefinitely, although updates may cost extra. A subscription licence is paid regularly and stops working when payment ends.

Company policies

An acceptable use policy defines allowed and forbidden behaviour on company systems. Other policies cover passwords, data handling, bring your own device (BYOD) and monitoring.

Staff are usually told that company systems may be monitored, and this is stated in policy. Technicians apply the policy consistently and escalate anything they are unsure about.

Non disclosure agreements

A non disclosure agreement (NDA) obliges one party to keep information confidential. A mutual non disclosure agreement (MNDA) binds both parties. A technician who sees customer or company secrets while working may be covered by one.