59

I'm based in the UK and am about six months into my first job as an Apprentice Software Dev, and came straight into it from college. All through high school and college we would easily bypass the school's filtering software by using web proxies, and as soon as one got blocked we'd just move on to another. I guess this habit's stuck with me, and today I received an email from my boss asking if I could explain all the proxies that I've been detected trying to access.

I didn't change any system settings, I visited websites which acted like proxies to bypass the restrictions.

Nowhere in my contract nor in the IT and Internet usage policies does it explicitly state not to use proxies or attempt to bypass the restrictions (which is the wording I was used to seeing at college), however it does say that the internet should only be used for business purposes.

Basically, I'm really worried about this email and don't want to be unceremoniously dumped after six months of otherwise good work. Am I right to be worried, and possibly facing disciplinary action/the boot, or is it something that can be sorted with a slap on the wrist and a promise not to do it again?

closed as off-topic by Dukeling, gnat, HopelessN00b, Jim G., Mister Positive Feb 21 '18 at 13:42

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking advice on company-specific regulations, agreements, or policies should be directed to your manager or HR department. Questions that address only a specific company or position are of limited use to future visitors. Questions seeking legal advice should be directed to legal professionals. For more information, click here." – gnat, HopelessN00b, Jim G., Mister Positive
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Comments are not for extended discussion; this conversation has been moved to chat. – Monica Cellio Feb 20 '18 at 20:08
  • 1
    @Sentinel If you want to make the case for reopening it, feel free to post a question on The Workplace Meta – Chris E Feb 21 '18 at 19:09
  • 1
    Luke, make sure you get back to us with how it panned out! – Sentinel Feb 21 '18 at 21:15
  • 1
    @Sentinel still nothing as of yet... I'm tentatively hoping you were right about this whole situation! – Luke Feb 21 '18 at 22:34
  • 1
    Does your policy say something about not attempting to circumnavigate security protocols? That's what you did and most policies have something like that to cover exactly this. – Ethan The Brave Feb 22 '18 at 16:44

13 Answers 13

24

Mate, I am going to throw an extra few of my own pennies into this. I have managed IT teams in the tens and had the privilege of hiring literally hundreds of developers.

  1. If it was up to me all senior devs would have full access to whatever.
  2. Unfortunately sometimes the context is a corporate setting where IT staff is affected by corporate general policy. While devs need admin PC access, sometimes that is blanket denied.
  3. I don't think accessing things by proxy is a big deal, and it should have no impact on security.
  4. If web access was a big deal, your network should be physically separate from the production network.
  5. I would give all senior devs home office. If you can access whatever there, why not at work.

This is OK for seniors. For your case, you need to earn trust and show that you respect things. As a boss, I know and expect that you youngsters will bend the rules, and it is my job to see you get all the tuition and discipline you need. Frankly, you didn't do much wrong, and what you did was expected, and if you seem worth your salt it will get overlooked easily, but you do have to earn that trust.

  • 9
    Finally someone speaking some sense. In my experience of apprentice software devs in the UK, management have always been incredibly lenient with them. They're really just kids, despite what they might think. They're not nearly expected to be fully productive. I see using web proxies as nothing more than a waste of company time, but plenty of people I know waste at least a bit of time browsing the web at work (including me as I'm typing this). I think it's a tendency that's impossible to fight. As long as people meet their deadlines, who cares how they manage their time? OP will be fine. – Michael Feb 21 '18 at 8:32
  • 3
    @Michael. Nail. Hammer. Head. IMO 90% of white collar corporate work is a waste of time. Most managers I know waste their lives in futile meetings that lead to nothing but more meetings. If the Western world was focused on efficiency and lean operations, the entire financial sector would have been replaced by one or two 5-man internet startups years ago. – Sentinel Feb 21 '18 at 11:20
  • Sorry, but I don't think this is a helpful answer. He's asking how to deal with a work situation that is clearly run with a different philosophy than the one you espouse. You're essentially saying he didn't do anything wrong, and that they are silly to think that way. While that may be so, they do think he did something wrong, they don't feel like you do, and his behavior is putting his employment at risk. His boss probably does not feel it's "expected," and the email does not indicate "overlooked easily." If the question was "how should I run my IT area" - perfect. That is not this. – PoloHoleSet Aug 27 '18 at 22:50
135

Personally, I'd have security escort you right out of the building, and ship your personal items to you, and flag your file with "Do not rehire".

You clearly violated policy by attempting to circumvent security. If you cannot come up with some solid and amazingly urgent business reason to circumvent security, violate protocols, and put your company at risk for intrusion, I'd start packing your things now, because you are done.

I've seen people fired for far less. One fellow was fired for telnetting from one computer to another within the LAN. To say you exercised bad judgment is an understatement.

Your best bet is to plead youth, ignorance, and some reason why you were using a proxy that was businesses related.

a bad hack can cost a company MILLIONS There are many proxies out there that are honey pots. Access one, and they travel back through your computer into your company's network, then hit it with ransomware.. it is SERIOUS BUSINESS

  • 2
    Comments are not for extended discussion; this conversation has been moved to chat. – Jane S Feb 21 '18 at 1:36
81

Nowhere in my contract OR in the IT and Internet usage policies does it explicitly state not to use proxies or attempt to bypass the restrictions (which is the wording I was used to seeing at college), however it does say that the internet should only be used for business purposes.

You're kind of expected to have a certain amount of responsibility in the working world. Actually in the real world, I've rarely, if ever had workplaces with AUPs, and one of them was basically "Don't do anything that would get you in trouble". That said, if you can't access something you shouldn't be.

I guess this habit's stuck with me, and today I received an email from my boss asking if I could explain all the proxies that I've been detected trying to access.

Good news is? They haven't told you to pack up your stuff and leave, especially as a new employee. You've been given a chance to explain yourself - which is a ... well, less than negative sign. That said, this is ... going to be hard to explain.

The best strategy here really is to prepare your resume, and go face the music. Be earnest, apologetic and well realise you've messed up. Listen to what they have to say, apologise anyway.

If you have a legitimate work related reason - like testing geographically, well, then, the truth works.

Its also worth considering most contracts have a notice period, and they could go "ok, we'll pay off your notice period. Please pack your stuff and leave"

  • 21
    That said, if you can't access something you shouldn't be. Well, that overstates it a bit. We both know web filters suck, and flag things too broadly, so it's possible (at least in theory, if not in this particular case) that some legitimate business resource (like a tech blog) got poorly categorized (like as social media) and blocked. Of course, the appropriate response there isn't "find a proxy", but to get IT to whitelist or recategorize the site. – HopelessN00b Feb 20 '18 at 15:24
  • 13
    @HopelessN00b - Exceptions can be requested. It literally takes minutes to create one. The statement is true, just because somebody does not understand the reasons they cannot access a website, does not mean one doesn't exist. – Ramhound Feb 20 '18 at 18:40
  • 4
    Overly restrictive firewalls are exactly the reason that I bring my own smartphone (with an unlimited data plan) to work. I don't access anything even remotely interesting from the work network other than sites within the LAN and company resources. Not sure what I'd do without an unrestricted pipe to read tech articles on Blogspot or download code from Github Gist. I wouldn't be able to do my job without these resources, but the company is too paranoid to allow them on the network, so I end up transferring data manually at ~120 WPM via keyboard. – allquixotic Feb 20 '18 at 19:30
  • 2
    Wait. Sympathy with a user? WHERE IS THE REAL HOPELESSN00B AND WHAT HAVE YOU DONE WITH HIM? More seriously - at this point, its a management/people issue over "I need this to do my job" issue While it can be dumb, OP is in the dog-house . Once its sorted out, OP can try to work out what he can get away with. – Journeyman Geek Feb 21 '18 at 0:50
  • 2
    @Ramhound you'd never had anything to do with security. Exceptions can be requested, and it can take months to create one. Most likely the reason for the exception would not exist when they are processed. – user50700 Feb 21 '18 at 8:55
50

At my place, in the UK, you would be gone. As a senior developer, I would be gone.

You could have asked if you can use your own private phone with 3G connection, or whether you can bring your private iPad in, with its own 3G connection, but absolutely no playing around with your company's network. You could have asked IT if they can make it possible to access what you want to access, and accepted their answer, whether "yes" or "no".

Your employment contract doesn't spell out everything you can and can't do. There are general rules that you have to take care of your employer's things, including their network, and using proxies on your employer's network is highly dangerous to your employer. It also indicates a great lack of good judgement, which is not a firing offence, but also not something that will convince them to let you stay.

  • 23
    Me too, but as an employer of 18 year old grads, I would expect this behavior and have a policy for dealing with it. Frankly, I think firing young apprentices is irresponsible if there is an obvious hope of salvation. I imagine in OPs place there will be a 3 strikes policy or akin. – Sentinel Feb 20 '18 at 22:03
  • 3
    @sentinel we're talking about adults here. Yes 18 is just starting out but really baby that point "don't break locks" should be expected to be known. – Andy Feb 21 '18 at 2:21
  • 10
    I don't see 18 as adult at all. I wouldn't want an 18 year old piloting on my 747 flight across the Atlantic. – Sentinel Feb 21 '18 at 5:24
  • 10
    @Andy agreeing with Sentinel. You don't go "poof I'm an adult now" mentally on your 18th birthday. Legally they are adults, but as a manager you should realise that this is their very first experience in the workplace. Some mature quicker than others, some mature quicker in different aspects, and that's (imo) the most important thing to remember. – Cyonis Feb 21 '18 at 8:10
  • @Belle Would we even be having this debate if he broke into a locked storage room at work? I think not. 18 is certainly old enough to understand that you don't just bypass rules because you don't like them. I'm sure he was told not to bypass proxies at school (which he stated he did), why would work be any different? You're right, the thinking is immature; so immature that as a manager I would decide he's not employable. Perhaps being fired will be the wakeup call needed to get his act together. – Andy Feb 21 '18 at 21:09
35

You are getting seriously beat up on this. Yes you intentionally bypassed security but sounds like you just did it to access content that would have been otherwise available to you. It is not a akin to a felony. Apologize, tell them you know it is wrong, and will not do it again. You will get disciplined but may not get fired.

  • 30
    The other answers seem to be missing the realpolitik of the situation - if you are an excellent and valued employee, you will almost certainly not be fired. If you're considered to be something of a waste of space already, you probably will be. – Carson63000 Feb 20 '18 at 7:24
  • 4
    @mods if you are going to truncate then truncate. There is not logic basis to keep the first comment over the rest. – paparazzo Feb 20 '18 at 20:17
  • 5
    Upon further investigation, it quite possibly is a felony in the UK: it's a fairly clear violation of the Computer Misuse Act of 1990. – Mark Feb 21 '18 at 0:04
  • 4
    @Paparazzi, he's not authorized to access the proxy from his work computer. It doesn't matter what he's using the proxy to access, it's the proxy itself that's relevant for 1.1(b). – Mark Feb 21 '18 at 1:42
  • 1
    @Clay07g It is the most utterly stupid move to take people fresh out of college and put them into a situation where their inexperience can cost human lives or cost the company millions if they make mistakes. 99% blame on management for letting that happen. – R. Schmitz Feb 21 '18 at 12:55
14

Am I right to be worried, and possibly facing disciplinary action/the boot, or is it something that can be sorted with a slap on the wrist and a promise not to do it again?

In professional environments almost never do they just "slap you on the wrist" and say "don't do it again"; in some places you usually are terminated right there if you fail to follow some security policy, or if not this is surely a security concern.

Yes, you should be worried. It is not clear for what purposes you used such proxies, but if it was to access non-work material (or some offending or dangerous content) then chances are you are in deep trouble.

If you used such proxies to access work-related content I suggest you explain that to your boss ASAP, and hope you have some way to verify that claim. This I fear is the only thing that could save you here.

Otherwise, I suggest you update your CV and prepare for a possible firing.

  • 2
    It wasn't work-related content, but it also wasn't any offensive or violent content - I don't remember exactly what, but it was probably some meme website. Is this still as serious as it sounds? – Luke Feb 19 '18 at 23:46
  • 9
    @LukeTaylor This is still serious, as why would you use proxies at all, if it is not but to access restricted content the company doesn't want you to see. Doesn't matter if it is a meme, if the company doesn't want that then you should not bypass such restrictions – DarkCygnus Feb 19 '18 at 23:50
  • 10
    @LukeTaylor, the company doesn't care if you are accessing offensive or violent content (I mean, they do, especially on company time, but that isn't the point), they care if you are accessing sites that could put malware or a virus on your computer that could infect the rest of the network. Their security policies are in place to keep that from happening. Using a proxy to bypass security, you put the whole company at risk. – Seth R Feb 20 '18 at 5:08
  • 6
    @Luke I don't remember exactly what, but it was probably some meme website - C'mon, man. It's gunna look really bad if they ask you where you went that potentially compromised their security and you can't even tell them. Also, filters aren't exclusively to keep you off offensive or violent sites; a lot (most?) of their job is to filer malicious site, where "some meme websites" could certainly quality. – Lord Farquaad Feb 20 '18 at 21:24
  • 2
    Never be worried. It is unhealthy. Everyone makes mistakes. Just learn and be happy. – Sentinel Feb 20 '18 at 22:05
13

Since they have logs of you doing it numerous times (with different proxies), the situation is pretty grim; any concept of forgiveness due to a "once-off mistake" has long gone out the window.

A lot of the answers here so far are basically speculating on whether or not you're likely to be fired, or at least seriously reprimanded. I don't live in the UK, but I think it's sufficient to summarize your situation by saying that the fate of your job really depends on:

  • The disposition of your boss / senior management / security staff at the company (and whether anyone at any of those levels is willing to stick up for you);
  • The letter and spirit of all agreements you've signed since hiring on at the company (including after joining, for any network or systems access you needed);
  • The amount of evidence (or lack thereof) that they are able to find about the nature of your proxy accesses, what you viewed/downloaded, and what impact it has had;
  • The cost-benefit analysis of: the situation- and country-specific legal burdens imposed on the company in order to justify firing you, vs. the cost of attempting to re-educate you and allow you to remain on staff, plus the risk of you doing it again and causing a more serious problem for the company;
  • How well you can explain exactly what you downloaded, accessed or viewed; how contrite you are when explaining it; and the degree to which you can back up your assertions with evidence.

I'm not here to speculate about the particulars of these variables. That depends entirely on your situation, and most of these are too personal for us to reasonably evaluate from afar.

What I will offer is some advice.

As a technologist, I understand that you can very easily get frustrated by needlessly restrictive firewall blocking rules at your place of work. They tend not only to block off-task activities like Youtube and Facebook, but also useful technical journals, like the blogs of individual technologists on Blogspot, as well as, for example, GitHub Gists. You probably can't get on IRC, either, which hampers your ability to interact with open source communities.

However, in the future, you can't simply route around the damage by using an open proxy. Instead, let me propose some alternatives, in descending order of "safety"; safety for your job, as well as overall security for the network you are a steward of defending by virtue of the fact that you have access to it:

  • If your IT department has a responsive way to request sites to be unblocked, and you need them for business purposes (or, honestly, if your company is easy-going, even if you want to browse harmless fun content during your lunch break), you can request that a firewall exception be made for a specific site or wildcard domain. If you aren't sure of the process to get an exception made, ask your boss, and keep escalating until you find the process. Be prepared to explain the nature of the content of the site and how you think it will benefit you (improving morale is a potential benefit even if it's a "fun" site like xkcd or something).
  • Ask for an officially supported "knowledge worker" internet access system. They might already have one. For example, you might be able to remote desktop into a system that has less restrictions on the sites it can access, but that system wouldn't have any direct LAN access to valuable company assets like the file server. If they don't have such a system, ask if you can use a VPN to a server that they specifically set up to be disconnected from the network and have a "no split tunneling" policy on your VPN software; this might allow you to connect to either the company network or a less-restricted Internet pipe, but not both at the same time.
  • Ask if you can connect to your own VPN. For this you will need to know how to set up a server, and pay for hosting (or host it at home if you have a sufficiently high-end connection and dynamic DNS or a static IP). Offer to let them audit the security of the system and commit that you will keep it patched, install a virus scanner/NIDS, and assume all responsibility for any breaches that trace back to your VPN usage. They might actually give you permission if you seem responsible and clueful enough.
  • Ask if you can bring in your own personal smartphone (or if you are 100% sure you can, do it). Unless you work in an extremely high security environment, it's likely that your company already allows this. Look around; do other coworkers like your superiors regularly have a smartphone or tablet? If they do, just ask them if it's company property or if they own it.
    • If other coworkers have their own personal cellular devices in the building and you aren't aware of this being a security violation, your best way to "view memes" (or blocked sites in general) at work is to use your phone, or get a small laptop and tether your phone to your laptop, assuming they allow you to have your personal laptop also. If personal devices are ubiquitous in your office, you shouldn't even need to ask for permission; just do it, and if you get called out, point at literally everyone else sitting around you and ask when they're going to call out the rest of your office, too.
    • If other coworkers don't have their personal devices, or if personal devices are disallowed, ask around if you can get a company-owned smartphone or tablet. These are almost always "off-net" (meaning you can't access sensitive company data on the LAN), or can legitimately be configured to be so; in this case, you can access your memes on this device. If the network connection (e.g. the LTE) is provided by the company, you should be careful not to view anything that could even slightly be construed as pornography or illegal activity on the device, but otherwise, non-business access might be OK. Ask whoever issues you the device whether you have a data limit, and what happens if you reach or exceed it, and make sure to work within those bounds (if any).
    • Never connect personal devices to the company network (WiFi or Ethernet) for any reason, unless you've been given explicit permission by your manager, in writing (and ideally also permission from your IT department, also in writing).
  • If you are going to go "off the rails" and do something without permission, don't use an open proxy, and your proxy should not be unencrypted under any circumstances.
    • Open proxies that allow just anyone to roll up and start proxying data are hideously insecure. On top of that, usually they will mine your data, monitoring both the domains you visit, as well as any traffic you produce that isn't end-to-end encrypted. If you login to an unencrypted (http) site over an open proxy, that's a very high guarantee that the proxy operator will steal your credentials. Ditto if you submit a session cookie over http.
    • Unencrypted proxies are almost as bad as open proxies, even if you're legitimately renting or own the underlying hardware, because any hops along the chain that are hostile or compromised can sniff your data (basically any MITM attack would steal your data). Use a TLS tunnel (like from stunnel) as a best practice if you don't want to or can't use a proper VPN protocol.

You might not think the latter two things matter, but if you did this and got caught but were able to say, "I know I violated company policy by using an unauthorized proxy/VPN, but I used my own hardware which is kept secure and patched, and the connection is encrypted with TLS; here is a list of sites I accessed and why" -- that would significantly help alleviate their concerns (as long as those sites were generally harmless).

I'm not sure if your company has grounds to take legal action as it is, but if you had the above explanation, they might not want to press charges even if they could. Basically, all the security risks and consequences are somewhat lower if your connection is (1) not an open proxy and (2) encrypted with an industry-standard strong encryption suite.

That doesn't mean you should go off the rails even in this situation, but doing it very sparingly and for legit business purposes would probably not result in sacking (though it's always better to ask permission than forgiveness for things like this).

10

Although what you did was silly and they could have grounds to sack you, I would read over the wording of your apprenticeship contract. Firing apprentices can be more tricky than other workers as the onus is on the employer to show that they are not breaking the terms of their agreement with you.

If it does not have clear behavioral policy outlined inside your contract, it could be seen as the employer 'breaking the terms of their agreement' which would entitle you, the apprentice, to full wages for the time you were supposed to be working in a tribunal.

This has significant implications for dismissal. If you break the terms of the agreement, the apprentice stands a good chance of being awarded at tribunal all the wages they would otherwise have been paid for the length of the contract. You therefore need to be very careful when it comes to dismissing apprentices.

Source

This would make it very unappealing to fire you as an apprentice however if they have a clear policy in place regarding this, I would be worried.

  • 16
    Using a proxy is not hacking. Downloading external software or using exstensions could open up the company to be hacked but it does not mean that OP hacked their system. True he almost definitely violated their IT policy / contract but he did not commit a crime. – Kyle Wardle Feb 20 '18 at 10:44
  • 5
    @kyle using a proxy on your works computer to access sites that your network at work doesn’t allow you to access is hacking. You are changing the company’s computer in ways that you are not authorised to do. – gnasher729 Feb 20 '18 at 12:42
  • 4
    @KyleWardle What you describe is "cracking". "Hacking" originally is just "doing things in a way it was not intended to do" and nothing more. – glglgl Feb 20 '18 at 13:58
  • 5
    I didn't change any settings, I visited websites which acted like proxies to bypass the restrictions – Luke Feb 20 '18 at 20:57
  • 2
    @Tyzoid The computer is part of the network. @ Luke In that case that is not hacking, the proxy site is a site like any other. – immibis Feb 21 '18 at 4:36
8

I'm not in the UK so I can't address the employment question, but I want to address this:

All through high school and college we would easily bypass the school's filtering software by using proxies, and as soon as one got blocked we'd just move on to another.

That doesn't fly in the working world.

Back in high school and college, it sounds like you treated the institutions you were in as an adversary, a nuisance to get around. That's not how the business world sees things. You are supposed to be on the same side as the company. If the company says "This is how we do things", it doesn't like it when you say "Well, I feel like doing it this other way instead."

You're getting paid. You're an employee. You're on the same side as the company you're working for. It will serve you well to see it that way.

  • It would be a good thing if you contacted the admin at your school/college and told them about this. They should warn the kids what can happen, and why. The school ought to update its security setup as well. – RedSonja Feb 21 '18 at 9:45
  • @RedSonja too late to do it now, or a good first step in the right direction? – Luke Feb 21 '18 at 9:59
  • @Luke a kindness to the younger generation – RedSonja Feb 21 '18 at 10:07
6

I think the answers here are harsh. I don't think you'll get canned unless something was compromised and they looked back in the logs and found a large amount of proxy connections. Whether you caused it or not, they could attribute the compromise indirectly to you.

The only way you can be legally tied to it is if your contract and/or computer login has any clause that states you cannot bypass security measures. From there, it really depends on how severe things are.

Either way it was a poor judgment call on your part. Since you're a intern, it's entirely possible they might not offer you a job unless your other performances are good.

  • 4
    > The only way you can be legally tied to it... What do you mean by this? I don't think he's worried about civil prosecution, only whether or not he gets fired, which are quite unrelated matters. I suspect they could dismiss him based on "inappropriate conduct" regardless of whether or not he signed some computer login clause (IANAL). – RJFalconer Feb 20 '18 at 17:39
5

Nowhere in my contract nor in the IT and Internet usage policies does it explicitly state not to use proxies or attempt to bypass the restrictions (which is the wording I was used to seeing at college), however it does say that the internet should only be used for business purposes.

Really?

If you think bypassing restrictions, firewalls and blocked content isn't specifically disallowed, the problem is most likely with you not WANTING to see it. Do you really think they went through all the trouble of blocking that stuff just so you can circumvent it?

And, yes, there is that clause in your IT policy, possibly the very first thing stated, that says something like "company equipment, networks and IT resources are meant for work-related purposes." What part of bypassing firewalls that block non-work materials do you think does not violate that? Even if it's not violent or obscene content, it is personal and blocked material. You are not only circumventing work done for a specific business reason, you are using time they are paying you for to do it. I'm pretty sure they aren't paying you to find proxies to get around their security measures, and I'm pretty sure they did not intend for their IT security professionals to spend their time tracking down and shutting down the proxies you are using. You are wasting company resources.

So, yes, this is serious, mostly because you are being completely unprofessional. You should be worried, because even if they don't dump you, you will be under constant scrutiny and on a very, very short leash. Learn from this mistake. You are there to work, first and foremost.

3

As someone who has been in a very similar situation (in my case I was proxying to home): Explain yourself, apologise and don't do it again. If they were looking to fire or discipline you, the first you'd likely hear of it would be a meeting invite in the very near future, and you'd walk into a room with your line manager and an HR rep. I'd recommend explaining in person - it's easier to express your sincere apologies this way, and it doesn't leave a digital trail, which could force your boss into involving more people, if you mess up what you say.

Also expect your line manager to be pulling reports of your browsing for the next few months - he'll be wanting to see you're behaving, so be super-clean with your browsing habits.

  • This is a good answer (I already upvote it). I'd like to ask you a question if you don't mind. Your user profile says you're in UK. I'd like to know: is using proxies in the office environment an offence? Why do I get the feeling that UK people seem to think it's okay and it's not that serious as Americans think? Thanks. – scaaahu Feb 21 '18 at 13:38
  • I can answer that. I worked in a bank once. There were loads of different departments: accounting, HR, product development of different types, etc. Most of these depts. don't need their staff using the internet at all really, so they put blocks and filters on internet access. They also lock down PCs and disable privileges.However, in an IT department, or a graphic design/marketing department, most of the work is creative and especially in IT you need to be able to install drivers, download stuff, etc.The network/PC admins don't really know how to easily make exemptions.That's all it is really. – Sentinel Feb 22 '18 at 10:41
  • @Sentinel No, you did not answer the question. I was wondering it seems to me UK people treat using proxies differently than Americans do? Your comment seem to imply that UK IT people don't really know how to easily make exemptions and American IT people know how to do the job? – scaaahu Feb 22 '18 at 11:58
  • @scaahu Using a web proxy is obviously not an offence in a criminal sense, but you are trying to compare UK with US when you should be comparing US and UK software development departments in a corporate setting. It is possible of course that in the US the software dev teams don't even have the proxies in place typically. That would be up to you to let us know. I think in general it's just common sense. Why on Earth would a web proxy be in any way harmful to security and who really cares if a software dev is surfing the web? If it's a problem in the US, then there is a lack of common sense. – Sentinel Feb 22 '18 at 12:41
-1

I'm based in the UK and am about six months into my first job

You are most likely still under the standard 6 month probationary period which is nigh-ubiquitous in the UK, during which time you can be summarily dismissed for any disciplinary matter without recourse to due process. Your contract probably spells this out. In addition, you do not receive your full workers' rights until you have been employed by a company for a period of at least 2 years and this directly impacts your current situation as it makes it impossible for you to claim unfair dismissal, barring exceptional circumstances. Your company will almost certainly claim that you committed gross misconduct which allows them to dismiss you without notice, pay or procedure. In addition, it could easily be argued that you have violated Section 3 of the Computer Misuse Act 1990 which is a serious criminal offence and gives your employer massive leverage over you: the police are only a phonecall away.

Bearing these factors in mind, my advice would be to resign immediately - thus avoiding the worst of the career black-marks caused by a dismissal for gross misconduct - and never do anything like this again. Life is a harsh teacher, as she gives the test first and the lesson afterwards.

  • 16
    This is exceptionally bad advice. If they want to fire him, he will be told. If he isn’t told, he isn’t going to be fired. You should never jump, and you should most definitely not jumped unless you are asked. There is no difference between “fired for misconduct” and “quit before he could be fired for misconduct” in a reference, but neither is likely to appear in a reference. – gnasher729 Feb 20 '18 at 14:30
  • 2
    I don't think that this is a criminal issue. Its true that in the US some courts have interpreted "authorised" as "whatever it says in the Acceptable Use Policy", and hence found that use outside the AUP is unauthorised and hence a crime. However I'm not aware that any authorities in the UK have taken this position. – Paul Johnson Feb 20 '18 at 15:06
  • 2
    Yeah they probably deliberately waited the 6 months because they DON'T want to fire him. – Sentinel Feb 20 '18 at 22:33
  • @Sentinel Possibly, if it is still slightly under 6 months, waited so they can justify extending the probationary period, to both give another chance and not be bound to give full employment rights for a further 6 months. – user2867314 Feb 21 '18 at 10:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.