What to do about a colleague playing pranks on a manager?

Question

I have the following situation at work. A colleague I work with sometimes plays pranks on a young manager. They've known each other for 3-4 years and the manager has the habit of forgetting to lock his laptop when leaving the office and the colleague does small pranks like sending funny e-mails to 2-3 close colleagues or changing the status (text) within the local messenger application.

This young manager is neither the manager of me nor the colleague playing the pranks.

Just to illustrate how these pranks look:

• change status to "herding cats @ {our department}"
• change status to "warp speed management" (linked to the recent promotion to management, hyperactive nature of the manager and his passion for Star Trek)
• change status to "most beloved manager in {department}" - this was also noticed by another manager (the same level, not his boss), but nothing happened except a few laughs
• send e-mail about buying lunch to us two - the manager actually bought us lunch and refused to accept our money and also became more careful about locking the computer, but still he forgets

This is not a new phenomenon for him. A long time ago, a female coworker used his e-mail to promise us sweets.

These seem like small pranks, but top management often sends e-mails about compliance (e.g. be careful about gifts from clients, be careful about data loss) and a manager leaving the computer unlocked is not exactly compliant.

Also, typically the manager does not seem to mind these pranks. Sometimes, he is a little angry, but there was never a serious discussion about ending the pranks.

I am thinking about the following:

• talk to the manager and insist upon always locking the computer - I did this, but the only improvement came after the offered lunch
• talk to the colleague - it is kind of weird, because we've worked together for some time and I somewhat understand these type of pranks (they are funny and help us deal with the stress)
• prevent pranks from being done - make sure to lock the computer when I see it unlocked (we work in the same room with offices close one to the other). However, this is quite impractical as managers are quite busy creatures moving around quite a bit
• do nothing - clearly the easiest way, but I am little worried about the possible compliance related issues.

Question: What to do about a colleague playing pranks on a manager?

Answer 1

You seem to be taking it upon yourself to fix a situation that is not your problem. ^TM

You're not the boss of either of these people, and no one else seems to think these pranks are a big deal. Rather than take it upon yourself to "fix" their behavior, just laugh it up with everyone else, and let nature take its course.

Either the manager will get called out for his lack of security awareness, or your coworker will go too far and get reprimanded. Either way, neither of them is likely to learn his lesson until that happens.

---

In my own organization whenever someone leaves their computer unlocked we'll use their account to send embarrassing emails to the team, and the corporate security manager (who's a chill guy, and laughs it up with the rest of us).

John's been a naughty, naughty boy.

That was around Christmas, and it spawned a chain of emails that the account owner will never live down, ever. Needless to say, he locks his computer now.

I've also seen people have their browser landing page changed to something embarrassing (but work safe), and I have personally had my desktop inverted (we all know the keyboard shortcuts for dealing with that now).

You soon learn to lock your station. However, this is a team effort, and security is very much on everyone's mind. If you're the only one pushing for it, and you have no buy in from management / are not the team lead, then you'll simply become that one humorless guy^TM every office seems to have at least one of.

Answer 2

So from what I can tell, you are not the manager of either employee playing the pranks or the manager who is getting pranks. It also doesn't sound like you work in IT Security or are in any way responsible for defining or enforcing company security policies.

You do nothing.

This is not your job. You have no authority here. The way you describe it, this has been going on for a while and it's pretty well known that it happens. There's a good chance that the people who are responsible for these employees' behavior are already aware and are just letting it slide. The only thing you have to gain by reporting this to someone is coming off as a stick in the mud and potentially harming your relationship with these colleagues.

Answer 3

Doing something humorous and harmless on the laptop is usually a good way to remind the user of the underlying security problems of leaving your laptop unlocked.

The problem is now that the joke is allowed to carry on, and the problem is self-replicating.

So, you can either inform IT or a compliance officer of the breach.

Or you can take a soft approach in pressing Win+L and locking the screen whenever you see it open.

Doing this repeatedly should be enough of a reminder.

You could reinforce the idea with moving his chair to a different part of the office. Having him find and push it back again can be part of the negative reinforcement tactic.

Answer 4

There are two things that are absolutely unforgivable with computer security.

One: Nobody leaves their laptop unlocked.

Two: Nobody touches anyone elses unlocked laptop.

Your colleague violates the unforgivable rule number 2. It is your job, and everyone's job in the office, to not let something like this happen. It's not funny. It's not a joke, and not a prank. It's a severe violation of your computer security.

Imagine you have a security incident and then it turns out that your colleague used laptops that he had no business of ever touching. Heads will roll.

PS. If you think people should be reminded in some way if they leave their computer unlocked, that's easy: Create a laptop screen sized cardboard with "computer unlocked" printed on it in huge letters, and two movable clock hands, and put it highly visibly on any laptop that is seen with an unlocked screen. Totally safe, just as embarrassing, and close to zero time wasted.

Answer 5

It's not your job to fix this. You don't manage either of the people involved. Stepping in directly is probably going to worsen your relationship with one or both of the coworkers involved, and possibly leave you in a lot of trouble if this does get out of hand. Unless your only motivation here is helping that manager, don't.

However, that doesn't mean you should turn a blind eye. Employees accessing and screwing around with eachothers computers and files is unprofessional and extremely bad for security. It's only a matter of time before one of these pranks leaks secure information or ends up embarrassing the company.

Inform IT or whoever's responsible for security issues about this, ideally by email so you leave a paper trail. Now it's for them to deal with; either they will and you're fine or they don't and you can stop worrying.

Answer 6

Well, in my company the rule is actually :

• Whoever sees a computer unlocked can send a mail to the team saying things like "breakfeast is on me tomorow" (nothing nasty, nor overly costly or challenging).

I dont know about your company culture, but since the rule n°1 of offices is : never let your computer unlocked, this small prank game is quite good at educating people to never forget.

Most of the newcomers pay the breakfeast once or twice and then never forget again.

So to answer your question, i'd do nothing except maybe join the pranker or remind the manager that locking his computer is not optional.

Answer 7

Most companies I've worked with explicitly condone harmless pranking when a colleague leaves their computer unlocked, specifically to teach them to lock their computer.

If an employee (manager or not) is tired of e.g. having his wallpaper changed whenever he walks away from his computer; then he should learn to lock his machine (which he should do anyway).

---

I'm not quite sure what you're trying to address here. You start off asking about how to handle pranking (= social behavior); but your question suddenly shifts into asking how to approach a manager about locking their computer (= system security).

Without a clear question, it's hard to give a clear answer. But I'll try to approximate your concern:

• If the pranking is malicious, the employee needs to be told keep it harmless or stop it (that's for the company to decide).
• Regardless of the pranking, the manager should be told to lock their computer whenever they walk away from it. While you could approach them on a personal level; based on your description, you cannot take this up with the manager in an offical capacity. If you must, talk to him about it once, but don't press the issue because it's going to cause friction.
• The pranking, if it is harmless, can be allowed if the company so chooses, since it teaches a lesson that the company already wishes to teach its employees.
• If the company does nothing to teach the manager to lock their computer, then that is the company's decision. It's not up to you to decide how the company should be run. Being reckless with data security is never a good thing; but selflessly forcing yourself to do the work that someone else (who is hired for system security) is failing to do is not a good thing either. Stick to the principle of "not my circus, not my monkeys", with the additional "but I will at least give them a heads up so they know about it".

Do not, UNDER ANY CIRCUMSTANCES, lock the manager's computer for him.

Not only does it fail to teach him his responsibility to do so himself, but if his computer is ever breached, you will be the first suspect. After all, you've been seen going to use his computer whenever he leaves. That's suspicious. You're basically willingly picking up the smoking gun.

Furthermore, using someone else's computer/account (therefore breaching security protocol) can be grounds for firing. Depending on the culture; you could be out of a job with no compensation.

Answer 8

If it is your goal is to help both your colleague and your team, then I would recommend having a discussion with this person about appropriate boundaries. I sometimes(OK More than sometimes) have difficulties with boundaries.

I am highly intelligent, and it is never my intent to actually harm anyone, emotionally or physically. But I think differently than most people. This results in my having boundaries that inappropriate at times. I count myself lucky that I never harmed anyone significantly prior to my learning to accept this limitation of my mind.

Pranks are fun, and as long as everyone can laugh they can build team unity. But when people stop laughing it becomes a problem. The problem is I(and I suspect your team mate) recognized the laughter from earlier pranks, and predict that you will react the same way. If the prank doesn't get the appropriate laughs then instead of considering the boundary, I tend to assume the problem was content, not context. This can result in my escalating my actions beyond, slightly inappropriate, to definitely inappropriate, possibly even down right rude. That was never my intent though. It is a lot like trying to fix a loosening screw by pounding it with a hammer. It works sometimes but eventually there is not going to be enough wood to hold at all.

How to address the issue

I recommend asking questions, instead of making statements. Asking questions leads the person to consider their own actions in a different light. These questions should not be targeted at a specific response.

Good Questions:

• What were you hoping would happen there?
• What did you expect "The Boss" to do?
• Do you want to understand why we are upset?

Bad Questions

• Why would you do that?
• Do you never think about the consequences?
• Why do you want to antagonize the boss?

Basically avoid judgement at all costs when trying to understand. Then if your colleague is really just being a jerk, you know to let him hang on the noose that he is tying with these pranks.

Answer 9

Start with finding your organization's policies on use of IT assets, password security, etc. Somewhere within the policies should be a policy that requires windows endpoints be locked unless the user is sitting within reach and view to prevent unauthorized use. There should also be a policy about allowing others to use your access, and by leaving a terminal logged in and unlocked this is what is indirectly happening. There should be policy about using, or even attempting to use, another's access. Lastly, there should be something in policy that explains roles & responsibilities, and what is expected of associates who witness any breaches of the aforementioned policies.

If any of those policies are not in place, then there really isn't anything you can do except try to educate and influence the others to use better practices.

But if those policies are in place, and especially one that requires reporting breaches to security, then that really is what you need to do. You don't have any discretion to provide leeway.

I worked at a company that is well known globally that had very well-defined policies, and from the moment you walk through the door on your first day you were taught what is expected of each individual regarding securing of access, terminals, etc. When a terminal is discovered unlocked/unattended, it is expected the others will notice and report it to security. But security does walk the floors and if security finds it first, then the person leaving it unlocked as well as the others in the vicinity would all be part of the incident report.

Answer 10

This is not your problem to solve (unless your security policy says otherwise)

That being said, if that manager or IT is looking for a quick solution that doesn't break the budget.

Then you could use this free open source Bluetooth solution on Windows (or one of these on a Mac). It won't be as good as ordering a special laptop, made explicitly for the purpose of security, but this solution may be good enough.

For instance, Bluetooth positioning won't not as granular (up to ~10 meters), plus it may actually be spoofable (even with a PIN) since it's not using the most secure encryption, but depending on the type of work you do, it may be good enough for your case since an intruder would still need to defeat it and still need physical access to the laptop as well.

And/or if your colleague or IT are willing to spend $27, they could buy this small fingerprint reader for a Windows laptop (or on a Mac, a similar device would cost $45).

This way, it could lock the screen when the manager steps away (more than 10 meters), but it could reopen the screen with his fingerprint only (instead of relying on Bluetooth for restarting the session). This last combo solution would be much more secure than relying on the Bluetooth utility alone. And this could be done easily with the utility. You would just need to leave the "Release command" field empty.

Answer 11

If we see an unlocked screen we open https://www.youtube.com/watch?v=dQw4w9WgXcQ or https://vimeo.com/45196609 pause it, and lock the screen.

It makes it clear you forgot to lock your screen, while not doing anything that may risk causing problems for you or causing harm to the organization's reputation.

In your case you could take this up on a team meeting, so there is an agreement on the prank level.

Answer 12

If he truly can’t develop the habit of locking, then he should get one of those alarms that go off when something breaks the light beam between the two parts. put it in the doorway. When he walks through, the noise will remind him to go back and lock the screen.

But of course he won’t do that until he stops thinking it isn’t really a security problem.