A magazine's YouTube channel was deleted after its editor resigned (2021) and what it shows about accounts missing from the offboarding list

A monthly business magazine lost its YouTube channel a few weeks after the editor who ran it resigned. The magazine had tried to cut off his access to all its accounts. It missed one: the company Google account that hosted the channel. A federal court order filed April 20, 2021, and a US Attorney’s Office release describe what happened. Damaging an account you no longer have permission to use falls under the federal computer crime law, explained in unauthorized access under the CFAA.

What happened

The magazine has print and online editions. It published all its videos on YouTube and embedded them in stories on its own website. A staff member wrote stories and managed the website and social media accounts, including the YouTube channel. The court found that he controlled the channel’s user name and password.

He quit suddenly in late January 2020, just under a year into the job. According to the court, he kept the user name and password after he left. The magazine tried to revoke his access to all its accounts right after he resigned. But the employee who did that didn’t know about the Google account hosting the channel.

On February 7, 2020, the new assistant editor looked at the channel and saw dozens of videos. In the early morning of February 9, someone signed in to the Google account from an iPhone. A few minutes later, the same phone changed the recovery email and the password. One recovery email address was deleted, and the only recovery options left were the former editor’s old work email address and his phone number. The court also noted screenshots from his laptop, taken in the same early-morning window, that showed login screens for other accounts in the magazine’s name. The release says the channel was deleted on February 10, 2020.

On February 13, the assistant editor couldn’t sign in, and the channel was gone. Links to its videos on the magazine’s website were broken. Google’s two-step verification sent its codes to the former editor, which stalled the magazine’s first attempt to take the account back. It eventually got in through another method that relied on his old work email address. The account history then showed the sign-in and the changes.

The magazine started a new channel. It restored some videos from backups but not all, and it lost nearly 700 subscribers it couldn’t get back. Rebuilding took almost 60 hours, and the investigation took another week. The court found it more likely than not that the former editor sent the command that deleted the channel, and that he had no authorization to do so.

The cause the record states

The court gave one reason the account stayed open. The magazine didn’t revoke his access to the Google account only because of its employee’s “initial ignorance of that account.”

The record also shows why one missed account was enough. He controlled the password, and after the change the only recovery options pointed to his old work address and his phone. So the magazine had to go through that old address to get the account back.

Corrective steps

The court order and the release describe how the magazine recovered the account and rebuilt the channel. They don’t describe changes the magazine made to its offboarding process afterward.

Controls usually expected after incidents like this

NIST’s security control catalog for federal systems, SP 800-53 Rev. 5, describes account controls that bear on this case. Control AC-2, account management, asks organizations to define the types of accounts allowed and to assign account managers. It also asks them to align account management with the process for people leaving or changing jobs. A company account that nobody responsible knows about can’t meet either step.

AC-2 also covers shared logins. It calls for a process to change the password of a shared or group account when someone is removed from the group. Control PS-4, personnel termination, asks organizations to disable a departing person’s system access within a set time and to revoke the logins tied to that person. It also asks them to keep access to the information and systems the departing person controlled. In this case the magazine lost that access when the recovery options and two-step codes pointed to the former editor.

YouTube offers a way to avoid a single shared Google login. Its channel permissions let you invite people by email with roles such as Manager, Editor or Viewer. YouTube Help says this gives people access “without needing access to your Google Account” and calls it safer than sharing your password. A Manager can do almost everything except delete the channel, which only the Owner can do. You remove someone under Settings, then Permissions. How the roles compare is covered in YouTube channel permissions for your team and an outside agency.

Accounts like this one are easiest to miss when nobody keeps a list. How to take inventory of shared accounts and what to record covers building that list. The account checklist for onboarding and offboarding covers what to close on the last day.

Questions to ask about your own setup

</content>
</invoke>