Is using internet proxies a sackable offence? [closed]

Question

I'm based in the UK and am about six months into my first job as an Apprentice Software Dev, and came straight into it from college. All through high school and college we would easily bypass the school's filtering software by using web proxies, and as soon as one got blocked we'd just move on to another. I guess this habit's stuck with me, and today I received an email from my boss asking if I could explain all the proxies that I've been detected trying to access.

I didn't change any system settings, I visited websites which acted like proxies to bypass the restrictions.

Nowhere in my contract nor in the IT and Internet usage policies does it explicitly state not to use proxies or attempt to bypass the restrictions (which is the wording I was used to seeing at college), however it does say that the internet should only be used for business purposes.

Basically, I'm really worried about this email and don't want to be unceremoniously dumped after six months of otherwise good work. Am I right to be worried, and possibly facing disciplinary action/the boot, or is it something that can be sorted with a slap on the wrist and a promise not to do it again?

Answer 1

Mate, I am going to throw an extra few of my own pennies into this. I have managed IT teams in the tens and had the privilege of hiring literally hundreds of developers.

1. If it was up to me all senior devs would have full access to whatever.
2. Unfortunately sometimes the context is a corporate setting where IT staff is affected by corporate general policy. While devs need admin PC access, sometimes that is blanket denied.
3. I don't think accessing things by proxy is a big deal, and it should have no impact on security.
4. If web access was a big deal, your network should be physically separate from the production network.
5. I would give all senior devs home office. If you can access whatever there, why not at work.

This is OK for seniors. For your case, you need to earn trust and show that you respect things. As a boss, I know and expect that you youngsters will bend the rules, and it is my job to see you get all the tuition and discipline you need. Frankly, you didn't do much wrong, and what you did was expected, and if you seem worth your salt it will get overlooked easily, but you do have to earn that trust.

Answer 2

Personally, I'd have security escort you right out of the building, and ship your personal items to you, and flag your file with "Do not rehire".

You clearly violated policy by attempting to circumvent security. If you cannot come up with some solid and amazingly urgent business reason to circumvent security, violate protocols, and put your company at risk for intrusion, I'd start packing your things now, because you are done.

I've seen people fired for far less. One fellow was fired for telnetting from one computer to another within the LAN. To say you exercised bad judgment is an understatement.

Your best bet is to plead youth, ignorance, and some reason why you were using a proxy that was businesses related.

a bad hack can cost a company MILLIONS There are many proxies out there that are honey pots. Access one, and they travel back through your computer into your company's network, then hit it with ransomware.. it is SERIOUS BUSINESS

Answer 3

Nowhere in my contract OR in the IT and Internet usage policies does it explicitly state not to use proxies or attempt to bypass the restrictions (which is the wording I was used to seeing at college), however it does say that the internet should only be used for business purposes.

You're kind of expected to have a certain amount of responsibility in the working world. Actually in the real world, I've rarely, if ever had workplaces with AUPs, and one of them was basically "Don't do anything that would get you in trouble". That said, if you can't access something you shouldn't be.

I guess this habit's stuck with me, and today I received an email from my boss asking if I could explain all the proxies that I've been detected trying to access.

Good news is? They haven't told you to pack up your stuff and leave, especially as a new employee. You've been given a chance to explain yourself - which is a ... well, less than negative sign. That said, this is ... going to be hard to explain.

The best strategy here really is to prepare your resume, and go face the music. Be earnest, apologetic and well realise you've messed up. Listen to what they have to say, apologise anyway.

If you have a legitimate work related reason - like testing geographically, well, then, the truth works.

Its also worth considering most contracts have a notice period, and they could go "ok, we'll pay off your notice period. Please pack your stuff and leave"

Answer 4

At my place, in the UK, you would be gone. As a senior developer, I would be gone.

You could have asked if you can use your own private phone with 3G connection, or whether you can bring your private iPad in, with its own 3G connection, but absolutely no playing around with your company's network. You could have asked IT if they can make it possible to access what you want to access, and accepted their answer, whether "yes" or "no".

Your employment contract doesn't spell out everything you can and can't do. There are general rules that you have to take care of your employer's things, including their network, and using proxies on your employer's network is highly dangerous to your employer. It also indicates a great lack of good judgement, which is not a firing offence, but also not something that will convince them to let you stay.

Answer 5

You are getting seriously beat up on this. Yes you intentionally bypassed security but sounds like you just did it to access content that would have been otherwise available to you. It is not a akin to a felony. Apologize, tell them you know it is wrong, and will not do it again. You will get disciplined but may not get fired.

Answer 6

Am I right to be worried, and possibly facing disciplinary action/the boot, or is it something that can be sorted with a slap on the wrist and a promise not to do it again?

In professional environments almost never do they just "slap you on the wrist" and say "don't do it again"; in some places you usually are terminated right there if you fail to follow some security policy, or if not this is surely a security concern.

Yes, you should be worried. It is not clear for what purposes you used such proxies, but if it was to access non-work material (or some offending or dangerous content) then chances are you are in deep trouble.

If you used such proxies to access work-related content I suggest you explain that to your boss ASAP, and hope you have some way to verify that claim. This I fear is the only thing that could save you here.

Otherwise, I suggest you update your CV and prepare for a possible firing.

Answer 7

Since they have logs of you doing it numerous times (with different proxies), the situation is pretty grim; any concept of forgiveness due to a "once-off mistake" has long gone out the window.

A lot of the answers here so far are basically speculating on whether or not you're likely to be fired, or at least seriously reprimanded. I don't live in the UK, but I think it's sufficient to summarize your situation by saying that the fate of your job really depends on:

• The disposition of your boss / senior management / security staff at the company (and whether anyone at any of those levels is willing to stick up for you);
• The letter and spirit of all agreements you've signed since hiring on at the company (including after joining, for any network or systems access you needed);
• The amount of evidence (or lack thereof) that they are able to find about the nature of your proxy accesses, what you viewed/downloaded, and what impact it has had;
• The cost-benefit analysis of: the situation- and country-specific legal burdens imposed on the company in order to justify firing you, vs. the cost of attempting to re-educate you and allow you to remain on staff, plus the risk of you doing it again and causing a more serious problem for the company;
• How well you can explain exactly what you downloaded, accessed or viewed; how contrite you are when explaining it; and the degree to which you can back up your assertions with evidence.

I'm not here to speculate about the particulars of these variables. That depends entirely on your situation, and most of these are too personal for us to reasonably evaluate from afar.

What I will offer is some advice.

As a technologist, I understand that you can very easily get frustrated by needlessly restrictive firewall blocking rules at your place of work. They tend not only to block off-task activities like Youtube and Facebook, but also useful technical journals, like the blogs of individual technologists on Blogspot, as well as, for example, GitHub Gists. You probably can't get on IRC, either, which hampers your ability to interact with open source communities.

However, in the future, you can't simply route around the damage by using an open proxy. Instead, let me propose some alternatives, in descending order of "safety"; safety for your job, as well as overall security for the network you are a steward of defending by virtue of the fact that you have access to it:

• If your IT department has a responsive way to request sites to be unblocked, and you need them for business purposes (or, honestly, if your company is easy-going, even if you want to browse harmless fun content during your lunch break), you can request that a firewall exception be made for a specific site or wildcard domain. If you aren't sure of the process to get an exception made, ask your boss, and keep escalating until you find the process. Be prepared to explain the nature of the content of the site and how you think it will benefit you (improving morale is a potential benefit even if it's a "fun" site like xkcd or something).
• Ask for an officially supported "knowledge worker" internet access system. They might already have one. For example, you might be able to remote desktop into a system that has less restrictions on the sites it can access, but that system wouldn't have any direct LAN access to valuable company assets like the file server. If they don't have such a system, ask if you can use a VPN to a server that they specifically set up to be disconnected from the network and have a "no split tunneling" policy on your VPN software; this might allow you to connect to either the company network or a less-restricted Internet pipe, but not both at the same time.
• Ask if you can connect to your own VPN. For this you will need to know how to set up a server, and pay for hosting (or host it at home if you have a sufficiently high-end connection and dynamic DNS or a static IP). Offer to let them audit the security of the system and commit that you will keep it patched, install a virus scanner/NIDS, and assume all responsibility for any breaches that trace back to your VPN usage. They might actually give you permission if you seem responsible and clueful enough.
• Ask if you can bring in your own personal smartphone (or if you are 100% sure you can, do it). Unless you work in an extremely high security environment, it's likely that your company already allows this. Look around; do other coworkers like your superiors regularly have a smartphone or tablet? If they do, just ask them if it's company property or if they own it.
  • If other coworkers have their own personal cellular devices in the building and you aren't aware of this being a security violation, your best way to "view memes" (or blocked sites in general) at work is to use your phone, or get a small laptop and tether your phone to your laptop, assuming they allow you to have your personal laptop also. If personal devices are ubiquitous in your office, you shouldn't even need to ask for permission; just do it, and if you get called out, point at literally everyone else sitting around you and ask when they're going to call out the rest of your office, too.
  • If other coworkers don't have their personal devices, or if personal devices are disallowed, ask around if you can get a company-owned smartphone or tablet. These are almost always "off-net" (meaning you can't access sensitive company data on the LAN), or can legitimately be configured to be so; in this case, you can access your memes on this device. If the network connection (e.g. the LTE) is provided by the company, you should be careful not to view anything that could even slightly be construed as pornography or illegal activity on the device, but otherwise, non-business access might be OK. Ask whoever issues you the device whether you have a data limit, and what happens if you reach or exceed it, and make sure to work within those bounds (if any).
  • Never connect personal devices to the company network (WiFi or Ethernet) for any reason, unless you've been given explicit permission by your manager, in writing (and ideally also permission from your IT department, also in writing).
• If you are going to go "off the rails" and do something without permission, don't use an open proxy, and your proxy should not be unencrypted under any circumstances.
  • Open proxies that allow just anyone to roll up and start proxying data are hideously insecure. On top of that, usually they will mine your data, monitoring both the domains you visit, as well as any traffic you produce that isn't end-to-end encrypted. If you login to an unencrypted (http) site over an open proxy, that's a very high guarantee that the proxy operator will steal your credentials. Ditto if you submit a session cookie over http.
  • Unencrypted proxies are almost as bad as open proxies, even if you're legitimately renting or own the underlying hardware, because any hops along the chain that are hostile or compromised can sniff your data (basically any MITM attack would steal your data). Use a TLS tunnel (like from stunnel) as a best practice if you don't want to or can't use a proper VPN protocol.

You might not think the latter two things matter, but if you did this and got caught but were able to say, "I know I violated company policy by using an unauthorized proxy/VPN, but I used my own hardware which is kept secure and patched, and the connection is encrypted with TLS; here is a list of sites I accessed and why" -- that would significantly help alleviate their concerns (as long as those sites were generally harmless).

I'm not sure if your company has grounds to take legal action as it is, but if you had the above explanation, they might not want to press charges even if they could. Basically, all the security risks and consequences are somewhat lower if your connection is (1) not an open proxy and (2) encrypted with an industry-standard strong encryption suite.

That doesn't mean you should go off the rails even in this situation, but doing it very sparingly and for legit business purposes would probably not result in sacking (though it's always better to ask permission than forgiveness for things like this).

Answer 8

Although what you did was silly and they could have grounds to sack you, I would read over the wording of your apprenticeship contract. Firing apprentices can be more tricky than other workers as the onus is on the employer to show that they are not breaking the terms of their agreement with you.

If it does not have clear behavioral policy outlined inside your contract, it could be seen as the employer 'breaking the terms of their agreement' which would entitle you, the apprentice, to full wages for the time you were supposed to be working in a tribunal.

This has significant implications for dismissal. If you break the terms of the agreement, the apprentice stands a good chance of being awarded at tribunal all the wages they would otherwise have been paid for the length of the contract. You therefore need to be very careful when it comes to dismissing apprentices.

Source

This would make it very unappealing to fire you as an apprentice however if they have a clear policy in place regarding this, I would be worried.

Answer 9

I'm not in the UK so I can't address the employment question, but I want to address this:

All through high school and college we would easily bypass the school's filtering software by using proxies, and as soon as one got blocked we'd just move on to another.

That doesn't fly in the working world.

Back in high school and college, it sounds like you treated the institutions you were in as an adversary, a nuisance to get around. That's not how the business world sees things. You are supposed to be on the same side as the company. If the company says "This is how we do things", it doesn't like it when you say "Well, I feel like doing it this other way instead."

You're getting paid. You're an employee. You're on the same side as the company you're working for. It will serve you well to see it that way.

Answer 10

I think the answers here are harsh. I don't think you'll get canned unless something was compromised and they looked back in the logs and found a large amount of proxy connections. Whether you caused it or not, they could attribute the compromise indirectly to you.

The only way you can be legally tied to it is if your contract and/or computer login has any clause that states you cannot bypass security measures. From there, it really depends on how severe things are.

Either way it was a poor judgment call on your part. Since you're a intern, it's entirely possible they might not offer you a job unless your other performances are good.

Answer 11

Nowhere in my contract nor in the IT and Internet usage policies does it explicitly state not to use proxies or attempt to bypass the restrictions (which is the wording I was used to seeing at college), however it does say that the internet should only be used for business purposes.

Really?

If you think bypassing restrictions, firewalls and blocked content isn't specifically disallowed, the problem is most likely with you not WANTING to see it. Do you really think they went through all the trouble of blocking that stuff just so you can circumvent it?

And, yes, there is that clause in your IT policy, possibly the very first thing stated, that says something like "company equipment, networks and IT resources are meant for work-related purposes." What part of bypassing firewalls that block non-work materials do you think does not violate that? Even if it's not violent or obscene content, it is personal and blocked material. You are not only circumventing work done for a specific business reason, you are using time they are paying you for to do it. I'm pretty sure they aren't paying you to find proxies to get around their security measures, and I'm pretty sure they did not intend for their IT security professionals to spend their time tracking down and shutting down the proxies you are using. You are wasting company resources.

So, yes, this is serious, mostly because you are being completely unprofessional. You should be worried, because even if they don't dump you, you will be under constant scrutiny and on a very, very short leash. Learn from this mistake. You are there to work, first and foremost.

Answer 12

As someone who has been in a very similar situation (in my case I was proxying to home): Explain yourself, apologise and don't do it again. If they were looking to fire or discipline you, the first you'd likely hear of it would be a meeting invite in the very near future, and you'd walk into a room with your line manager and an HR rep. I'd recommend explaining in person - it's easier to express your sincere apologies this way, and it doesn't leave a digital trail, which could force your boss into involving more people, if you mess up what you say.

Also expect your line manager to be pulling reports of your browsing for the next few months - he'll be wanting to see you're behaving, so be super-clean with your browsing habits.

Answer 13

I'm based in the UK and am about six months into my first job

You are most likely still under the standard 6 month probationary period which is nigh-ubiquitous in the UK, during which time you can be summarily dismissed for any disciplinary matter without recourse to due process. Your contract probably spells this out. In addition, you do not receive your full workers' rights until you have been employed by a company for a period of at least 2 years and this directly impacts your current situation as it makes it impossible for you to claim unfair dismissal, barring exceptional circumstances. Your company will almost certainly claim that you committed gross misconduct which allows them to dismiss you without notice, pay or procedure. In addition, it could easily be argued that you have violated Section 3 of the Computer Misuse Act 1990 which is a serious criminal offence and gives your employer massive leverage over you: the police are only a phonecall away.

Bearing these factors in mind, my advice would be to resign immediately - thus avoiding the worst of the career black-marks caused by a dismissal for gross misconduct - and never do anything like this again. Life is a harsh teacher, as she gives the test first and the lesson afterwards.