68

I have the following situation at work. A colleague I work with sometimes plays pranks on a young manager. They've known each other for 3-4 years and the manager has the habit of forgetting to lock his laptop when leaving the office and the colleague does small pranks like sending funny e-mails to 2-3 close colleagues or changing the status (text) within the local messenger application.

This young manager is neither the manager of me nor the colleague playing the pranks.

Just to illustrate how these pranks look:

  • change status to "herding cats @ {our department}"
  • change status to "warp speed management" (linked to the recent promotion to management, hyperactive nature of the manager and his passion for Star Trek)
  • change status to "most beloved manager in {department}" - this was also noticed by another manager (the same level, not his boss), but nothing happened except a few laughs
  • send e-mail about buying lunch to us two - the manager actually bought us lunch and refused to accept our money and also became more careful about locking the computer, but still he forgets

This is not a new phenomenon for him. A long time ago, a female coworker used his e-mail to promise us sweets.

These seem like small pranks, but top management often sends e-mails about compliance (e.g. be careful about gifts from clients, be careful about data loss) and a manager leaving the computer unlocked is not exactly compliant.

Also, typically the manager does not seem to mind these pranks. Sometimes, he is a little angry, but there was never a serious discussion about ending the pranks.

I am thinking about the following:

  • talk to the manager and insist upon always locking the computer - I did this, but the only improvement came after the offered lunch
  • talk to the colleague - it is kind of weird, because we've worked together for some time and I somewhat understand these type of pranks (they are funny and help us deal with the stress)
  • prevent pranks from being done - make sure to lock the computer when I see it unlocked (we work in the same room with offices close one to the other). However, this is quite impractical as managers are quite busy creatures moving around quite a bit
  • do nothing - clearly the easiest way, but I am little worried about the possible compliance related issues.

Question: What to do about a colleague playing pranks on a manager?

  • 52
    What is your goal? – Lumberjack Apr 9 '18 at 15:22
  • 4
    I find that keyboard shortcuts are much easier to make habitual than start-menu-selections. Does the manager in question know about the Windows-key + L shortcut for locking the computer? – Jesin Apr 9 '18 at 19:50
  • 9
    What do you want to fix (and why)? The pranks, or the manager not locking his computer? Your question focuses on the pranks, but the only concrete concern you voice is about compliance, which has to do with the locking, not the pranks. – marcelm Apr 10 '18 at 11:30
  • 2
    Domain computers should have properly configured power options, that will lock laptops on close and after so many minutes of inactivity. With that, there is little room for forgetting to lock the computer. – Helen Goussarova Apr 10 '18 at 19:19

12 Answers 12

284

You seem to be taking it upon yourself to fix a situation that is not your problem. TM

You're not the boss of either of these people, and no one else seems to think these pranks are a big deal. Rather than take it upon yourself to "fix" their behavior, just laugh it up with everyone else, and let nature take its course.

Either the manager will get called out for his lack of security awareness, or your coworker will go too far and get reprimanded. Either way, neither of them is likely to learn his lesson until that happens.


In my own organization whenever someone leaves their computer unlocked we'll use their account to send embarrassing emails to the team, and the corporate security manager (who's a chill guy, and laughs it up with the rest of us).

John's been a naughty, naughty boy.

That was around Christmas, and it spawned a chain of emails that the account owner will never live down, ever. Needless to say, he locks his computer now.

I've also seen people have their browser landing page changed to something embarrassing (but work safe), and I have personally had my desktop inverted (we all know the keyboard shortcuts for dealing with that now).

You soon learn to lock your station. However, this is a team effort, and security is very much on everyone's mind. If you're the only one pushing for it, and you have no buy in from management / are not the team lead, then you'll simply become that one humorless guyTM every office seems to have at least one of.

  • 39
    I agree w/r/t "not your problem." I've thought about answering this question similarly, but I've hesitated because it seems really dependent on the culture and formality of the employer. I've worked in places where these pranks were commonplace (and even done them myself - we used to "steal" the mice of anyone who left their workstation unlocked) but I've worked in other places where the prank would be just as much a cause for discipline as the unlocked workstation, so it's hard to know if we should encourage or discourage the OP... – dwizum Apr 9 '18 at 14:04
  • 4
    Maybe it's because I'm at the end of a stressful day and feeling tired, but "not your problem TM" made me laugh a bit :D – Paula Hasstenteufel Apr 9 '18 at 15:21
  • 15
    David Hasselhoff is our primary security incentive. We have a policy to leave your pc locked when not at your station, and if you forget, someone will inevitably change your background to a scandalous Hasselhoff picture. Needless to say, not many pc's are left unlocked anymore. – SethWhite Apr 9 '18 at 15:40
  • 5
    I've found out the hard way on multiple occasions that if I allow workplace shenanigans like this to occur with no pushback on my part, there's a real chance it rebounds on me in some way. For example, this manager almost certainly has a personal suspicion of who is doing this, and there's a high probability that suspicion is incorrect... – T.E.D. Apr 9 '18 at 17:20
  • 8
    @AndreiROM I think what T.E.D. is saying is that the OP has talked to the manager about locking his computer before, so it is possible the manager may suspect (wrongly) that the OP is behind the pranks if the OP doesn't bring to someone's attention that this issue is going on. This has the potential to sour the relationship of the OP to this manager. – called2voyage Apr 9 '18 at 19:42
25

So from what I can tell, you are not the manager of either employee playing the pranks or the manager who is getting pranks. It also doesn't sound like you work in IT Security or are in any way responsible for defining or enforcing company security policies.

You do nothing.

This is not your job. You have no authority here. The way you describe it, this has been going on for a while and it's pretty well known that it happens. There's a good chance that the people who are responsible for these employees' behavior are already aware and are just letting it slide. The only thing you have to gain by reporting this to someone is coming off as a stick in the mud and potentially harming your relationship with these colleagues.

20

Doing something humorous and harmless on the laptop is usually a good way to remind the user of the underlying security problems of leaving your laptop unlocked.

The problem is now that the joke is allowed to carry on, and the problem is self-replicating.

So, you can either inform IT or a compliance officer of the breach.

Or you can take a soft approach in pressing Win+L and locking the screen whenever you see it open.

Doing this repeatedly should be enough of a reminder.

You could reinforce the idea with moving his chair to a different part of the office. Having him find and push it back again can be part of the negative reinforcement tactic.

  • 1
    The soft approach is much better, as we all three know each other for a while and talking to IT about this seems like the ultimate solution. Thanks for the quick answer. – Alexei Apr 9 '18 at 13:25
  • 4
    Yes, but be aware of the larger picture here - if there's no one around to lock the screen on his behalf and something bad happens...? You need to seriously address this issue at some point... – Snow Apr 9 '18 at 13:28
  • 8
    @SandraK Because it's pain having your screen lock out while you're spending more than a minute or so looking at a spreadsheet or reading a document or speak to someone at your desk for a little while, or waiting for a process to finish. You try setting your timeout at 1 minute and see how frustrating it gets after a while. – Snow Apr 9 '18 at 13:35
  • 3
    @Snow Set it to 5 mins then... (or whatever preference to that user) – Sandra K Apr 9 '18 at 13:38
  • 30
    @SandraK Locking after a period of inactivity isn't actually secure, because there's still the possibility that somebody will gain access to your computer in between you leaving it and the lock due to inactivity occurring. It does, however, make people think it's secure ("Oh, it's fine, the computer will just lock itself."), making them less likely to actively think and care about security. If your computer is unattended, it needs to be locked immediately. If your computer is attended, but you're not actually using it, it doesn't need to be locked. – Anthony Grist Apr 9 '18 at 15:12
16

There are two things that are absolutely unforgivable with computer security.

One: Nobody leaves their laptop unlocked.

Two: Nobody touches anyone elses unlocked laptop.

Your colleague violates the unforgivable rule number 2. It is your job, and everyone's job in the office, to not let something like this happen. It's not funny. It's not a joke, and not a prank. It's a severe violation of your computer security.

Imagine you have a security incident and then it turns out that your colleague used laptops that he had no business of ever touching. Heads will roll.

PS. If you think people should be reminded in some way if they leave their computer unlocked, that's easy: Create a laptop screen sized cardboard with "computer unlocked" printed on it in huge letters, and two movable clock hands, and put it highly visibly on any laptop that is seen with an unlocked screen. Totally safe, just as embarrassing, and close to zero time wasted.

9

It's not your job to fix this. You don't manage either of the people involved. Stepping in directly is probably going to worsen your relationship with one or both of the coworkers involved, and possibly leave you in a lot of trouble if this does get out of hand. Unless your only motivation here is helping that manager, don't.

However, that doesn't mean you should turn a blind eye. Employees accessing and screwing around with eachothers computers and files is unprofessional and extremely bad for security. It's only a matter of time before one of these pranks leaks secure information or ends up embarrassing the company.

Inform IT or whoever's responsible for security issues about this, ideally by email so you leave a paper trail. Now it's for them to deal with; either they will and you're fine or they don't and you can stop worrying.

  • 4
    It's a severe security violation. It's everyones job to intervene. – gnasher729 Apr 9 '18 at 13:52
8

Well, in my company the rule is actually :

  • Whoever sees a computer unlocked can send a mail to the team saying things like "breakfeast is on me tomorow" (nothing nasty, nor overly costly or challenging).

I dont know about your company culture, but since the rule n°1 of offices is : never let your computer unlocked, this small prank game is quite good at educating people to never forget.

Most of the newcomers pay the breakfeast once or twice and then never forget again.

So to answer your question, i'd do nothing except maybe join the pranker or remind the manager that locking his computer is not optional.

  • From what I have heard some 1-2 years ago, there were similar pranks in another department, mostly providing chocolate and ice-cream for co-workers. However, I do not know what happened afterwards. I would say that the company culture is somewhat relaxed. On the other hand, the top managers insist on compliance, with special focus on reporting any potential inappropriate gift from a client. – Alexei Apr 9 '18 at 15:51
  • 3
    There's a whole world between getting gifts from the client and getting gifts from coworkers, there shouldnt be conflict of interest in the second case :) – Maxime Apr 9 '18 at 16:10
  • Similar in our team (though we are using our internal team chat instead of email, this is usually faster). I had to bake some muffins some weeks ago. Just make sure to append "... and locks the computer after writing that" to the rule, so the computer doesn't stay unlocked. – Paŭlo Ebermann Apr 9 '18 at 19:07
  • Yup, it was donuts at my former workplace. As often as not it was a manager who forgot, and they dutifully brought in the donuts as an acknowledgement of their mistake. Most folks didn't forget more than once or twice, but there was one who tended to go about 8 weeks between breakfast runs. – FreeMan Apr 11 '18 at 18:13
7

Most companies I've worked with explicitly condone harmless pranking when a colleague leaves their computer unlocked, specifically to teach them to lock their computer.

If an employee (manager or not) is tired of e.g. having his wallpaper changed whenever he walks away from his computer; then he should learn to lock his machine (which he should do anyway).


I'm not quite sure what you're trying to address here. You start off asking about how to handle pranking (= social behavior); but your question suddenly shifts into asking how to approach a manager about locking their computer (= system security).

Without a clear question, it's hard to give a clear answer. But I'll try to approximate your concern:

  • If the pranking is malicious, the employee needs to be told keep it harmless or stop it (that's for the company to decide).
  • Regardless of the pranking, the manager should be told to lock their computer whenever they walk away from it. While you could approach them on a personal level; based on your description, you cannot take this up with the manager in an offical capacity. If you must, talk to him about it once, but don't press the issue because it's going to cause friction.
  • The pranking, if it is harmless, can be allowed if the company so chooses, since it teaches a lesson that the company already wishes to teach its employees.
  • If the company does nothing to teach the manager to lock their computer, then that is the company's decision. It's not up to you to decide how the company should be run. Being reckless with data security is never a good thing; but selflessly forcing yourself to do the work that someone else (who is hired for system security) is failing to do is not a good thing either. Stick to the principle of "not my circus, not my monkeys", with the additional "but I will at least give them a heads up so they know about it".

Do not, UNDER ANY CIRCUMSTANCES, lock the manager's computer for him.

Not only does it fail to teach him his responsibility to do so himself, but if his computer is ever breached, you will be the first suspect. After all, you've been seen going to use his computer whenever he leaves. That's suspicious. You're basically willingly picking up the smoking gun.

Furthermore, using someone else's computer/account (therefore breaching security protocol) can be grounds for firing. Depending on the culture; you could be out of a job with no compensation.

  • > Do not, UNDER ANY CIRCUMSTANCES, lock the manager's computer for him. This would depend on the company. One I worked for, it was policy to lock the person's machine, and then report it. And do nothing else. This was thanks to a prank that went too far, and the nature of the data possibly available on certain people's machines. – Tharglet Asimis Apr 11 '18 at 9:52
  • @ThargletAsimis: If the company explicitly tells you to do so; then there is no reasonable argument for considering OP as a suspect (assuming he reported it afterwards). But in absence of a rule that suggests you should lock an unlocked computer, it would be more prudent to not unnecessarily implicate yourself. – Flater Apr 11 '18 at 9:57
4

If it is your goal is to help both your colleague and your team, then I would recommend having a discussion with this person about appropriate boundaries. I sometimes(OK More than sometimes) have difficulties with boundaries.

I am highly intelligent, and it is never my intent to actually harm anyone, emotionally or physically. But I think differently than most people. This results in my having boundaries that inappropriate at times. I count myself lucky that I never harmed anyone significantly prior to my learning to accept this limitation of my mind.

Pranks are fun, and as long as everyone can laugh they can build team unity. But when people stop laughing it becomes a problem. The problem is I(and I suspect your team mate) recognized the laughter from earlier pranks, and predict that you will react the same way. If the prank doesn't get the appropriate laughs then instead of considering the boundary, I tend to assume the problem was content, not context. This can result in my escalating my actions beyond, slightly inappropriate, to definitely inappropriate, possibly even down right rude. That was never my intent though. It is a lot like trying to fix a loosening screw by pounding it with a hammer. It works sometimes but eventually there is not going to be enough wood to hold at all.

How to address the issue

I recommend asking questions, instead of making statements. Asking questions leads the person to consider their own actions in a different light. These questions should not be targeted at a specific response.

Good Questions:

  • What were you hoping would happen there?
  • What did you expect "The Boss" to do?
  • Do you want to understand why we are upset?

Bad Questions

  • Why would you do that?
  • Do you never think about the consequences?
  • Why do you want to antagonize the boss?

Basically avoid judgement at all costs when trying to understand. Then if your colleague is really just being a jerk, you know to let him hang on the noose that he is tying with these pranks.

3

Start with finding your organization's policies on use of IT assets, password security, etc. Somewhere within the policies should be a policy that requires windows endpoints be locked unless the user is sitting within reach and view to prevent unauthorized use. There should also be a policy about allowing others to use your access, and by leaving a terminal logged in and unlocked this is what is indirectly happening. There should be policy about using, or even attempting to use, another's access. Lastly, there should be something in policy that explains roles & responsibilities, and what is expected of associates who witness any breaches of the aforementioned policies.

If any of those policies are not in place, then there really isn't anything you can do except try to educate and influence the others to use better practices.

But if those policies are in place, and especially one that requires reporting breaches to security, then that really is what you need to do. You don't have any discretion to provide leeway.

I worked at a company that is well known globally that had very well-defined policies, and from the moment you walk through the door on your first day you were taught what is expected of each individual regarding securing of access, terminals, etc. When a terminal is discovered unlocked/unattended, it is expected the others will notice and report it to security. But security does walk the floors and if security finds it first, then the person leaving it unlocked as well as the others in the vicinity would all be part of the incident report.

  • AFAIK, the policy states that the employee should always lock the computer when not using it, but there is unclear what others can/can not do about it. I will check again. Thanks. – Alexei Apr 9 '18 at 16:16
2

This is not your problem to solve (unless your security policy says otherwise)

That being said, if that manager or IT is looking for a quick solution that doesn't break the budget.

Then you could use this free open source Bluetooth solution on Windows (or one of these on a Mac). It won't be as good as ordering a special laptop, made explicitly for the purpose of security, but this solution may be good enough.

For instance, Bluetooth positioning won't not as granular (up to ~10 meters), plus it may actually be spoofable (even with a PIN) since it's not using the most secure encryption, but depending on the type of work you do, it may be good enough for your case since an intruder would still need to defeat it and still need physical access to the laptop as well.

dialog box showing the Bluetooth Proximity Lock utility

And/or if your colleague or IT are willing to spend $27, they could buy this small fingerprint reader for a Windows laptop (or on a Mac, a similar device would cost $45).

small fingerprint reader

This way, it could lock the screen when the manager steps away (more than 10 meters), but it could reopen the screen with his fingerprint only (instead of relying on Bluetooth for restarting the session). This last combo solution would be much more secure than relying on the Bluetooth utility alone. And this could be done easily with the utility. You would just need to leave the "Release command" field empty.

0

If we see an unlocked screen we open https://www.youtube.com/watch?v=dQw4w9WgXcQ or https://vimeo.com/45196609 pause it, and lock the screen.

It makes it clear you forgot to lock your screen, while not doing anything that may risk causing problems for you or causing harm to the organization's reputation.

In your case you could take this up on a team meeting, so there is an agreement on the prank level.

  • 1
    Could you add a brief description of what's in that video, please? I am just getting a message that "the user has not provided this video for your country". – O. R. Mapper Apr 10 '18 at 21:43
  • 1
    It's probably a helpful, informative video on IT security ... did I keep my face straight enough? – Will Crawford Apr 11 '18 at 6:40
  • @O.R.Mapper It's just a Rick Roll. – David K Apr 11 '18 at 12:21
-1

If he truly can’t develop the habit of locking, then he should get one of those alarms that go off when something breaks the light beam between the two parts. put it in the doorway. When he walks through, the noise will remind him to go back and lock the screen.

But of course he won’t do that until he stops thinking it isn’t really a security problem.

protected by Community Apr 10 '18 at 19:19

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.