Take the 2-minute tour ×
The Workplace Stack Exchange is a question and answer site for members of the workforce navigating the professional setting. It's 100% free, no registration required.

There has recently been a change in the corporate hierarchy. The former CEO/President is now, technically, just an employee (although, to be sure, an employee with a lot of weight) and a shareholder. The new CEO/President has asked me to copy some documents from the ex-CEOs laptop discreetly and without anyone's knowledge. Additionally, the request was made verbally, and I have no documentation to back me up if I get caught.

It feels wrong to me... you know, the whole, "with great power..." kind of thing.

My questions are:

  • Is there any reason to believe that this a legitimate request?
  • What can I do to protect myself and ensure my actions are legal?
share|improve this question
20  
Do you know why your boss wants you to secretly copy the files? Is there a reason you can't just ask ask the former CEO for them? The fact that your boss doesn't want the former CEO to know raises a lot of warning flags for me. –  David K Sep 2 at 14:59
22  
Make sure you get these orders in writing (printed page, whatever)! I don't suspect there's a problem, but if something goes wrong, you don't want someone saying you were trying to steal the documents. –  Michael Kohne Sep 2 at 15:00
1  
@JoshP I'm not sure how asking someone to copy some files could result in "legal issues". Are you expecting the former CEO to somehow damage company information or relationships? That would be extremely unprofessional on his part, and could be a suable offense. –  David K Sep 2 at 15:14
1  
@DavidK, my apologies, I was unclear. The legal issues would be something unrelated to my task. I meant that there may be documents on the computer that pertain to legal issues. And I agree that the later would be extremely unprofessional. –  JoshP Sep 2 at 15:21
2  
@JoshP I'm still not sure why your boss feels the need to hide this data copy from the former CEO, and maybe you don't know either. I don't doubt that the company has the right to access company property at any time, but something still seems fishy. –  David K Sep 2 at 15:55

8 Answers 8

up vote 17 down vote accepted

I have been in this position before, and while it could be something illegal or unethical, it could just as well be a perfectly legitimate request with a legitimate reason.

When someone in a high access position like this leaves their position, there's often legitimate concern that he/she will destroy company data that they feel entitled to (or want to deny the company), and/or use that company data in their next role to undermine their former employer or for personal gain (think poaching customers, or bringing business relationships with them to the next place). Obviously, making sure this doesn't happen is a matter that must be dealt with discretely, as tipping the person off will only make it happen faster, and generally speaking, no one wants these suspicions to be common knowledge.

You could ask for written permission... but that would probably conflict with the goal of discretion, and especially if it's a company owned laptop, in the US, that data belongs to the company, not the ex-employee, regardless of his position. So the company's agents (the new CEO) are legally entitled to that data, and allowed to be as discrete or as obvious as they want about getting it.

My advice to you is that rather than just copying the files requested, is to take a backup of the laptop, with whatever means you have at your disposal and document the request and process. (Disk image, same software you use to backup your servers, scripted robocopy or whatever.) Compared to a targeted copying of important files, backing up an executive's machine when they leave is hard to frame as snooping or unauthorized access, which makes it difficult for you to get thrown under the bus, especially if you keep a written record of what you did when you did it, and at whose request. In this case, you would then give the backup to the new CEO, and instruct him on how to search and extract the files he wants. That way if there's any malfeasance going on, you just did what a good IT guy does, and made backups, while the new CEO was the one who went snooping through the backups.

And, going forward, it's a good idea to get this process enshrined in an official policy - it protects you from any accusations if it's just the normal process, and every now and then, you'll get to be the hero when you can pull the critical files that some ex-employee had on their machine that no one knew they were missing, until they need them, NOW.

share|improve this answer
8  
Although I agree that it's a perfectly legitimate request, I disagree that written permission would cause an issue with discretion. The NEW CEO is making this request, I'm sure they could easily hand the tech a document telling him to perform the action without that becoming common knowledge. Even if the new CEO just wrote something in word, printed it out and signed it. –  Chris Lively Sep 3 at 0:23
2  
@BroSlow Instead of going through the data for the CEO, and handing off what's relevant, this gives the data to the CEO and lets him decide what's relevant, which is safer for everyone involved. The company doesn't have an extra set of eyes going over sensitive/confidential data, and the IT guy isn't going to see anything he's not supposed to. Also, this takes something that could be perceived as "snooping" or "unauthorized access" by the IT guy and turns it into part of a sysadmin's normal job duties - backing up the company's important data. If it's not already backed up, it should be. –  HopelessN00b Sep 4 at 4:52

What a quandary! In the US, a company owns the network and the data transmitted across it. Additionally, if the former CEO's laptop was issued by the company, the company has complete access to it as well. Legally, you should be fine following the direction from you new CEO, but get that direction in writing.

If you don't get the direction in writing, then your work could be characterized as hacking. Think about it like this: if your company tells you to get the data, it's safe; if you go to get the data on your own, it's a crime. It is very possible that the new CEO is simply curious about the data, and if you are caught and don't have written permission to get the data, he could easily throw you under the bus. In this case, denying he asked you to get the information and then telling the authorities that you committed a hacking crime.

Now, ethics. If your company's new CEO is asking you to gather the information in a manner that feels wrong, it probably is. When reviewing electronic records, companies usually maintain a chain-of-evidence that starts with the original request for data in writing. Once that is done, the request gets approved by Legal, and then you go to work. The request can be as simple as "get the data" or as explicit as "all e-mails from date a to date b, and install a keylogger". Once you get the data, you treat it as evidence and strictly follow legal's requirements for maintaining the chain of evidence.

In your case, your new CEO asked you to pull data from the old CEO's laptop in a manner that suggests he doesn't care about the chain-of-evidence. He also asked you to do so in a manner that is dangerous for you if you are caught. I would ask for the request in writing, or not do it all. In fact, if the worst thing happens and he fires you for not getting the information, at least you'll be unemployed and not in jail.

share|improve this answer
4  
Thanks for your answer. I'll ask for the direction in writing. I don't think that will be a problem. –  JoshP Sep 2 at 15:26
17  
From a European point of view, the first paragraph is really a surprise. In Europe, an employer can't check a machine of an employee, etc. Only for urgent matters (like the prevention of theft or sharing data with a competitor), this is allowed. Such cases are sometimes settled at the European Court of Human Rights. –  CommuSoft Sep 2 at 18:36
15  
@CommuSoft From a UK standpoint this case sounds illegal under the Data Protection Act, which does take into account EU rights to privacy and correspondence. I imagine a lot of countries have laws against convert unjustified monitoring. I've read up a bit and it looks like, as usual, Americans are going to have to suck it up. –  Nathan Cooper Sep 2 at 19:17
4  
In the U.S., it depends on whether the employee has a reasonable expectation of privacy. Many (if not most) companies explicitly state that employees have no expectation of privacy when using company equipment. This is also almost always true for government employees. Many employers (including the federal government) also go to the length of putting a pop-up message that displays to users at logon warning them of the lack of an expectation of privacy on the machine that they are logging in to. –  reirab Sep 2 at 21:10
3  
In general the advice to get it in writing is solid, however I disagree that this would constitute hacking. The OP appears to be in the Tech department and has access to perform these actions. Provided the company has an employee manual that includes text about no privacy for company computers there's even less of a case. Could you cite any existing cases and/or law to support your supposition? I ask simply because I'd like to know more. The only way I can think of is for the OP to have a legal issue is if the employer decides to bring action which seems incredibly unlikely. –  Chris Lively Sep 3 at 0:30

Who owns the former CEO's laptop? If it's a corporate laptop then the documents on it are also the property of the company, assuming your legal team were sober when they wrote/reviewed your acceptable use policy.

It might not be pleasant to have to sneak around to do this but it's certainly not a legal issue, and possibly not even an ethical one.

share|improve this answer
1  
Thanks for your answer. I've certainly had the suspicion like in the second bullet point above. –  JoshP Sep 2 at 15:04

Seconding the motion. If it's a company laptop, policy is almost certainly that the company has the right to read anything on that machine. However, you do want this directive in writing, to make clear that you are doing it on behalf of the company, as directed by management, rather than on your own. If in any doubt, ask if you can get the blessing of the legal department (without mentioning who the target is, just a hypothetical employee). Legal may also have advice on what tools you can and can't safely use, and what files you should particularly avoid looking at.

If it's the employee's personally owned machine, that's a different kettle of worms and you probably want the legal department to confirm that, by using it for company business, the employee has granted the company the right to retrieve this data. Getting the order in writing will probably protect you, but on this version I'd play it safe.

share|improve this answer
  1. You need to determine whether this is an official request to surreptitiously copy these docs from the CEO's laptop, or a surreptitious request to surreptitiously copy these docs from the CEO's laptop. Paper trail, please. You don't want to experience the equivalent of the standard "Mission: Impossible" tape recording: "... in the event of your death or capture, the Secretary of Defense will disavow any knowledge of your actions ..." In sum: the request must be official, and it must be in writing.

  2. You need to determine whether the CEO's laptop is the property of the company or the property of the CEO. The official request for your action must either specify that the laptop is the company's property or that the laptop is the CEO's property but the company has implicit permission to access it.

If both of these conditions are not met, the new CEO's request is a "no-go" as far as I am concerned, if I were in your position.

My answer is based on the presumption that you work in the US.

share|improve this answer

You need to get the request in writing. If this request were above-board, you'd have it already.

[US] Company hardware and the files contained therein are still company property and they are entitled to the data, but there are less-shady ways to exercise this right. The situation you're describing sounds personal-- if it were a legal matter, your firm or the DA would have hired professional forensic technicians to fulfill this request instead of coming to you secretly. If you even turn on that laptop, the evidence is tainted and will be thrown out in court.

Either way, it's none of your business why he's asking. It's only your business how he's doing it.

Write to him instead, mentioning "per your request to retrieve files from _'s laptop, if this is a legal matter, the evidence will be inadmissible..." and try to coax authorization out of him that way.

He's not going to admit to wanting to snoop on former employees' personal data, so at the very least you can protect both of you by asking him to make a formal request of you to do something broad like "please make a backup image of the ex-CEO's laptop for archival's sake/to comply with our official corporate document retention policy." He can pick through it at his leisure to find whatever he needs, and you can disavow any knowledge of the contents.

Don't ask, don't tell, but insist on a paper trail. When this ends with him posting intimate photos of the ex-CEO's wife on 4chan, when it comes back to you (and it will), you'll have a paper trail showing his request and the subsequent chain of custody and be able to make a case for plausible deniability.

share|improve this answer

If your boss asks you to do a full backup of the company pc, you do a full backup of the company pc. If there is no written document about it, your boss probably did not ask you. ;)

Simple as that, just ask him for it, he is probably fine with signing it, but like most people just not aware of the potential risks he puts you in.

The "full backup" might prevent you from snooping around and leaving timestamps on files, and so on. Not sure how that works.

share|improve this answer

Do it, and do it quietly.

This sort of request could very well be the corporation gathering details and preserving information in the event of either a lawsuit against the company from the CEO, or a lawsuit against the company due to shareholder and or other financial fraud. It could very well be coming from the legal company to your boss and he or she might himself or herself be under the very same call for discretion. It is better to do it, and keep a low profile about it, then it is to appear to be dragging your feet on behalf of a CEO who is on his or her way out due to reasons that you may not know.

share|improve this answer
2  
You're recommending a course of action based on nothing more solid than your unrestrained speculation. That's unacceptable as an answer. –  Vietnhi Phuvan Sep 3 at 6:09

protected by Community Sep 3 at 15:41

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.