126

I'm one of the two team members who work in IT support at my company. I recently had a laptop turned in for hard drive replacement. While copying the files to the new drive, I noticed a document named "John Doe.docx", where John Doe is my full name. I returned the laptop after replacing the drive, but have yet to destroy the old drive.

Would it be ethical for me to read the document having my name? I understand it'd generally be considered an integrity violation to read emails and other documents of others. That's not what I'm doing – or is it?


EDIT: I accepted an answer and have wiped the disk without opening anything.

enter image description here

  • 5
    Comments are not for extended discussion; this conversation has been moved to chat. – Jane S Apr 23 '18 at 21:12
  • Was this document planted for you to read? We had a situation years back where someone (we'll never know who) "accidentally" left an envelope on our desk with the departments annual bonus written on it... Clearly, we were not supposed to be privy to this information, and knowing and revealing it is a dismissable offence, but it did reveal some serious inequality throughout the department... – RemarkLima Apr 29 '18 at 22:23

17 Answers 17

337

As an IT support person, you are only authorized to do what is needed to resolve the users' IT issues. In this case, the user wants his disk replaced without losing his data. Hence, you only need to move the data from the old disk to the new disk, and replace the disk.

Snooping into the contents of the disk because you found them "interesting" is a breach of trust, whether or not it is a violation of company policy or local laws.

  • 1
    Comments are not for extended discussion; this conversation has been moved to chat. – Jane S Apr 24 '18 at 22:32
  • 5
    Yes. This. I'm not sure why OP thinks this would be different than reading someone's email. – PoloHoleSet Apr 25 '18 at 16:33
151

Would it be ethical for me to read the document in my name?

I understand it'd generally be considered an integrity violation to read the emails and other documents of others. That's not what I'm doing -- or is it?

It's obviously not your document, so of course you would be reading the documents of others without their permission.

While you might get away with it, this would certainly be unethical. I think you already know that.

Now you get to decide how ethically you wish to act.

  • 53
    The company, yes. The support guy, no. The support guy is not the company. – gnasher729 Apr 23 '18 at 22:06
  • 15
    Seems like it would be extremely easy to get away with being unethical in this instance. "Oh, sorry, I saw it was my name so I assumed it was instructions for me or something" – ESR Apr 24 '18 at 4:19
  • 5
    donjuedo - IT staff do not need an additional rule not to snoop. They actually need agreement in order to look at anything on an employees laptop outside that needed for doing their job. – Rory Alsop Apr 25 '18 at 19:35
  • 9
    Since IT people often have almost unlimited access to data (which is essential to perform the job), integrity is even more important than for a employee that might be administratively restricted. Even having the idea to violate this trust is a very dangerous career move. – user60393 Apr 26 '18 at 1:58
  • 3
    @donjuedo You don't agree to a list of things you cannot to do and assume that everything else is allowed. You agree to a list of things you can do, and stick to doing only things from that list. What you are suggesting is impractical because you will have a pretty huge list of things to prepare and you still can't cover everything. Is the IT guy allowed to play games on the user's laptop, or use it to keep his food warm, for example? It is absurd to think any IT team will make such a list of things you cannot do. – Masked Man Apr 26 '18 at 5:26
101

I'd like to give an alternative answer, because it's the first thing that popped into my head when I read the post:

Was the document on the desktop of the computer? Or otherwise in some place you were meant to see? Does the owner of the laptop know that you personally would be doing the hard drive replacement?

These questions are important because the document may have been meant for you to see. Perhaps special instructions for while you're replacing the hard drive.

However, if the document is out of the way (and by that I mean pretty much anywhere besides the desktop) and/or accompanied with files with other peoples names then it can be safely concluded that you weren't meant to find/read it.

Adding thanks to @Bilkokuya:

If there's any doubt that the file was actually meant for you to see you should ask about it. If you're too anxious about it to ask, that's probably a sign that it isn't meant for you.

  • 8
    If the OP can conclude it was meant for them to see, does that mean they are allowed to open it? I agree my thought was it was put there for them to see. (Though potentially to entrap) – IDrinkandIKnowThings Apr 23 '18 at 13:17
  • 11
    @BooleanCheese I think it's important to include that point in your answer - that if you think it was for you to see, you still need to ask permission first, to clarify that was the intention. – Bilkokuya Apr 23 '18 at 14:35
  • 13
    The "destop" of the user is not any more legitimate than any other location (for prying purpose). For a hard drive backup then replacement, it is not always necessary to even fire up the computer with the original OS ... and in any case not under the laptop user username ... so the IT support person should never land on the "destop" of another user. – Hoki Apr 23 '18 at 16:22
  • 55
    If the owner of the laptop meant the admin to read the document, they should have notified the admin beforehand, or have passed the document by other, less ambiguous means. – MauganRa Apr 23 '18 at 17:18
  • 32
    How about a name like "John Doe -- Read this before disposing of old drive.txt"? :) – Barmar Apr 23 '18 at 19:18
52

Aside from the above excellent and correct answers, can you get away with asking the mildly snarky question 'So .. out of wild curiosity, I noticed that your hard drive has a file with my name on it, which I did not open. What's in it??' Then don't say a word, and don't give the impression that you opened the file.

  • 9
    I think this is the way to approach this. Though I might ask, is that anything I should be concerned with rather than what's in it. – IDrinkandIKnowThings Apr 23 '18 at 13:20
  • 10
    Yes. It gives the guy the chance to explain "Oh coincidentally I have a client/friend/family member that has the same name as you. That document was for them." or some other innocent explanation. – Wilson Apr 23 '18 at 13:47
  • 24
    @Wilson the owner of the computer has nothing to explain. The op is not a cop/guardian/ward/judge. Should you come to me asking about the content of files i have on my work pc I would take you to HR straight away for snooping. What's next? You defend yourself sayin 'I read my name and I want to know what's going on!'? Not a good defense imo – Paolo Apr 23 '18 at 17:14
  • 17
    @Paolo: It's not really "snooping" to see a filename by accident. Anything further beyond asking would be, but there's no indication that the asker has done this. – Mooing Duck Apr 23 '18 at 18:28
  • 11
    @R.. - "There's no reason copying drives should be showing you any data during the copying process". Copying the drive is certainly not likely to be a file-by-file sort of copy, but it might involve rebooting the PC to the desktop, checking basic operation, performing maintenance like chkdsk and defrag, application and OS updates, temp and cache file deletion, etc. it's at least possible that there are plenty of opportunities for legitimately stumbling upon the file, depending on where it was. – Kevin Fegan Apr 24 '18 at 12:00
17

This would not only unethical, but a reason for dismissal. Unless he stores something like child porn on his hard drive, you are not entitled to check his files. Maybe he just stores some information about you so he can remember you, or he stores your contact information so he knows who the IT guy is. Anyway, it is not your business, so you should do your job and leave it at that.

EDIT: If you suspect illegal stuff you should inform your manager and law enforcement.

  • But what reason is there to suspect illegal content? The user might be an employee who has felt harrassed by the IT person, and as is highly recommended, written down all the events - obviously in a file named after the harasser. – gnasher729 Apr 23 '18 at 20:36
  • Even if there was suspicion of illegal content - OP should still raise concerns with their higher up and seek permission/go-ahead to investigate. "Lone Cowboy" investigation, no matter what the content may be, is still snooping. – Robotnik Apr 24 '18 at 6:09
  • even if... actually definitely if there is CP on there, you do not want to be checking his files. – Baldrickk Apr 24 '18 at 10:11
  • Seeing a direct reference to yourself does morally entitle you to look, as you are the owner of your name. However, for what justification would child porn entitle you to check his files? Child porn is not an offense against you unless it's your child. And enforcement of CP laws is for law enforcement to do. In fact, if you suspect there's CP, take your hands off the computer immediately. Do NOT tell your boss, only call 911 and let the police handle it. If you witness it while you have possession of the laptop you can be imprisoned. Not the time to worry about your employer's policies! – Billy Apr 24 '18 at 17:17
  • Made an edit for clarification, thanks for the comments. – QEDemonstrandum Apr 25 '18 at 6:31
9

This opens Pandora's Box

Suppose you read it. And there's something actionable in there.

What do you do about it? Or more to the point, how do you do nothing about it?

Can you really look and interact in the same way, knowing of their unrequited romantic feelings for you?

Can you really bite your tongue continuously, knowing of their very negative assessment of your work that has its facts so very wrong?

Do not put yourself in that position, as it is a miserable place to be.

Aside from all the legal and ethical issues already discussed.

7

As others said: it is not ethical.

Did you previously ask a request to the department which the owner of this computer belong? I do not think you would have found interesting stuff in this file.

I used to work part-time support when I started in IT. I went through so many sessions one on one with a user to check if the workstation transfer was successful.

Those files were often:

  • The original resume
  • An aggregate of multiple requests related to the same person
  • A short description of the person for the inside company news
  • The job description
  • Evaluation
  • etc.

Also, usually, interested files are not named with the intent. I never encountered a file named "layout", but "employees structure version +1". People know that IT people have all access, and they behave accordingly.

In conclusion, I recommend you to not open this file. I previously witnessed a network administrator fired on the spot for opening a honeypot called "salary.xls". There is not a lot to gain and lot to risk.

  • 31
    I previously witness a network administrator fired on the spot for opening a honey pot called "salary.xls". this is an urban legend. I am not saying it never happened, but the reality is "I was opening it to make sure it was not something that shouldnt have been in a place that it was. There is no reason for a salary spread sheet to be in the common shared folder for Group D" is a valid sysadmin response – IDrinkandIKnowThings Apr 23 '18 at 13:24
  • 9
    "I previously witness a network administrator fired on the spot for opening a honey pot called "salary.xls"." Did you actually see this happen in front of yourself? – a CVn Apr 24 '18 at 7:51
  • 2
    @MichaelKjörling I saw the network administrator hired for two weeks escorted trough the corridor with a red face. I ask a senior coworker what happened and he told me management give him new privileges a few days ago and he use it a moment ago to open the honey pot file "salary". The management state it was a breach of trust, so they fire him. Company size: 30-40 employees, managers was also technical guys that do not mess with anything that can endanger the agency reputation. It was not the first and the last one being fired while I work here. – Sebastien DErrico Apr 24 '18 at 11:37
  • At another company, it happen they was an issue with the budget department folders permissions. While checking the permissions, the network administrator explained me our duty was to report anomaly. If we want to access a protected file, we need to call a meeting with a member of the department that act as a witness. Never open any file on our own, it often leave trace and look shady on IT. Example: Last access of the protected management_review.docx file: Your IT guy. – Sebastien DErrico Apr 24 '18 at 12:01
6

It's not ethical to read a file unless you have permission to access it.

But it's not unethical to be curious about something you saw in plain sight. I assume you saw the file name in the copy dialog for a second while it was copying. If you really want to, you can go ask HR/your boss and tell them you noticed a file with your name while copying everything and ask if you can open it.

If you get written permission (over an E-Mail or something), you are more than welcome to see it. Chances are maybe it is HR data about you and they don't want you to see it either.

4

You have a responsibility to report to your manager anything harmful, unprofessional or inappropriate that you discover. Most companies have policies about what laptops can be used for, and what content can be stored on the hard drives (i.e. porn isn't allowed).

Personal information, or documents pertaining to you specifically would be inappropriate if that person shouldn't have such a document as part of their job.

You should not have hesitated. The moment you discovered the file, then you should have stopped what you were doing and gone straight to your manager, and brought that person back to your desk and said "Look at what I just discovered. Should I be concerned?"

You didn't do that. You completed the task, returned the laptop and kept the original hard drive.

The original hard drive does not belong to you. Do not access the contents of that drive again without permissions from the owner, or otherwise part of your job activities.

You can ofcourse bring this drive to your manager, and explain that you saw something that concerned you. Sit down with him/her and explain how this makes you feel, explain that you didn't read the document and ask for an explanation as to why such a file would exist.

If your organization has you working independently without a clearly defined manager, then bring the hard drive to human resources.

It's possible people might criticize you for seeking help with this matter, but try to understand that doing what is morally correct often results in criticism. If you fear that criticism and take matters into your own hands, then things will be far worse if you get caught.

  • 1
    This is the correct answer in my opinion. Most others focused on the privacy rights of the author of the document, but the subject of the document has privacy rights too. I would immediately take the drive to my manager, for no other reason than to ensure that my bank account number was not in the document. – Michael J. Apr 26 '18 at 19:58
  • 2
    That is absolute nonsense. The file could be named "John Smith" with contents "Monday, 22nd, 10am, hand laptop over to John Smith for reformatting". And if you report this file, why aren't you reporting all files that are titled with names of people? – gnasher729 Apr 29 '18 at 21:12
  • It's tricky because the ethics of digging around to find files and the ethics of investigating something you discovered without searching are somewhat different. I don't think it's unreasonable in this case to query what the file is, in much the same way you might query the content of an envelope with your name on it. It's also important to remember that the ethics of what you do with information are separate from the ethics of how you acquired that information. – Kaithar Apr 30 '18 at 10:59
3

Is the person whose computer you were working on likely to have a valid reason for having a document using your name and possibly having information about you (rather than for you) in it? Were there other documents named after other staff members? As I see it, you have two options. One is to ask that person if the document was given your name because it was meant for your attention, even if it was dated months ago. It could be that it was originally meant for you but then something changed and they didn't delete it. The other is to put your question to HR, in asking them if it would be correct or not (it's natural to be curious) they will clarify the matter, and if there's no valid reason for this person to have a file named after you (or anyone), it will bring it to their attention.

  • +1 for "likely to have a valid reason for having a document using your name and possibly having information about you" ... you don't have to look in the document to bring it to someone's attention. Same goes for a file named "Credit card numbers.txt" – Kaithar Apr 30 '18 at 11:06
3

Since we are in a professional environment where privacy and ethics are two very important aspects, it is very wrong to open such documents, especially if it pertains to us.

Being an IT Support Assistant myself, I have come across several similar situations where I have had to literally wage a war against my urge to open such documents. I can tell you one thing, it is definitely very hard to stop yourself from opening the document. Being curious is basic human nature, and it is not wrong wanting to open the document. You will have sleepless nights thinking about that document, But, over time, you will learn to let go of that urge.

EDIT

As I was saying in my first sentence of my initial answer, since we are in a professional environment at work, we need to respect privacy of fellow employees and act as per the ethics. If a document is not intended for you, even if it might something about you, like having your name on it, for example, your performance report drafted by your lead intended for your manager, you are not supposed to see the contents, unless you are authorized to see it. And since your job in this scenario is to repair the computer, you have to strictly stick to it and do nothing else.

  • 1
    Welcome to Stack Exchange! Could you talk in more detail why it is wrong? (If OP knew why it was wrong, s/he would not need to ask if it's wrong.) – employee-X Apr 23 '18 at 18:15
  • 1
    Sure. I thought the first sentence of my answer was answering why it was wrong, but upon giving it a second read, @employee-X I agree I need to explain more. See edits! – Dashamlav Apr 23 '18 at 18:19
3

I'd say opening files would be unethical and beyond that it might be illegal or against the rules of your company.

In addition to that, I have several questions to you (don't answer, just think about it):

  • Is there a strict privacy policy about such data copying? Would opening this file get you fired, fined or otherwise be a negative experience?
  • Is there a security audit going on in your company to find out if this exact sort of situation happens and if the personnel replacing the hard drives take a look at what's on them?
  • Would anyone be interested in setting you up for this kind of situation? Would anyone benefit from exposing your possible breach of trust/privacy? (Perhaps a personal vendetta, who knows)

Keep in mind, that if you're copying the data on a computer connected to the local network or the outer internet, opening files which may contain links to external images may result in web requests being sent to certain addresses, which can be logged, and if the url is unique, it can be traced to you to definitively say that this could not have been anybody else but you.


A very improbable but not technically impossible scenario: The file contains a certain series of bits which when read without the preceding bits outside of the file (as a full drive copying tool would) by a specially crafted hard drive firmware can record the act of opening the file in some way that would be detectable later when the drive's data is copied. Or it could trigger an electric circuit on the hard drive's controller which could be hooked up to anything! Who knows! :D

  • "if the url is unique..." This might be enough to link it to the specific document being opened, but alone is not enough to link to a specific user. For that, they would need to log the identity of the PC accessing the url, and possibly more. – employee-X Apr 23 '18 at 18:18
3

There is more to it than just ethics here. Even if it is ethical to read it. You will most likely be reading things without or in the wrong context.

What if that happens, what are you then going to do? My guess is that most people will not go to that person to tell them they just read a file from there computer and want clarification. This is also an answer to the question whatever it is ethical.

So simply ask yourself. If what I read needs clarification, would I (or others from my current region, country, etc.) feel comfortable telling that person you read it?

  • If circumstances including the placement of the file are such that it might be a message addressed to you, you examines it merely enough to determine whether or not that is the intention, there would be no need to request "clarification" of anything if it was not a message addressed to you. – supercat Apr 23 '18 at 20:54
3

The above answers (I think it's safe to assume that they will all stay above this one) cover the OP's ethical question. I'm going to answer a slightly different question, which is this: suppose you succumbed to curiosity and looked at the file--what is the ethical thing to do now?

Consider:

  • The knowledge in your brain should not be there.
  • It's there because you breached someone's trust.
  • You can't remove the knowledge from your brain.

The only thing left that you can do is to mitigate the damage caused by your breach of trust.

In my opinion, the best way to do that is to ensure that no other entity in the universe is affected by that knowledge. Don't use that information to make any decisions. Don't use it to change your opinion of the person whose trust you breached. Don't tell the person you have that information. Don't tell your closest confidant/spouse/lawyer that information. In short, act as if you never knew it. When the information comes back to mind, remind yourself that you only know it as a result of a breach of trust and that you are ethically required to act as if you do not know it.

This is hard, but you made the mistake, you should accept the consequences.

2

I have to disagree with 99% of the other answers.

As an admin assigned to recover data you can access everything IMO, because part of the job is making sure that the data is readable/functional.

To ensure that, you need to open a few files sporadically at least.

It's also possible that this file includes information adressed to you, especially if it's in a location the client knows or hopes you will see, eg. the desktop or the folder you are supposed to rescue.

If you rescue the data, but it turns out the rescue mechanism wasn't good enough to recover the data, then the client will send you the laptop again, complaining about your slacky work.

If you rescue the data, but ignored the clients instructions written in the file (which might be extremely important), you might get fired or warned or sued for your slacky work.

Also under most jurisdictions, you are entitled to request information about you, that is stored by companies, so the file that is handed to you is accessible in multiple ways and you are definitly allowed to read it.

  • 1
    I wanted to say some of this but was afraid to. – nomen Apr 26 '18 at 20:08
  • 1
    -1 You do not and should not need to open any files which do not belong to you without permission. If it is necessary to "open a few files sporadically", then this task must be done with the consent of the owner of the data, who must agree on files to be opened.Preferably the check done by the owner themselves. If you have concerns about the integrity of the data, then the first thing you must do is raise your concerns with the owner of that data, and inform them of the risks, then discuss with them the means to verifying the data afterwards. – Ben Cottrell Apr 28 '18 at 10:26
  • 2
    @BenCottrell: Minor niggle - it's not necessarily clear that the company laptop's usual user is the owner of any data on it, whether they created it or not. Sometimes the company will claim ownership of its entire contents under all conditions. Now of course that doesn't address the question of whether the IT guy should be opening it, but just sayin'... – Lightness Races with Monica Apr 30 '18 at 10:52
  • 1
    @LightnessRacesinOrbit it's standard practice for a company to have the right to inspect any data an employee places on a company resource, the argument that the product of work carried out using company resources is the property of that company is related but separate. And that also doesn't address if the IT guy should access that data :p – Kaithar Apr 30 '18 at 11:14
  • 2
    @Kaithar: Well, that's what I just said :P – Lightness Races with Monica Apr 30 '18 at 11:16
0

This is a question you should check with the corresponding security procedures of your company.

Definitely not rely answers from random people on the internet!

-1

Yes, despite the various ingenious arguments that have been presented, it's almost certainly unethical for you to read it.

But, if you suspect it's ADDRESSED to you - well, you can always ask!

(By the way, what DID it contain? We know you looked!)

  • 3
    It's being downvoted because you are directly mocking other answers/posters here, have a large amount of sarcasm (or malice, hoping it's sarcasm?), and effectively don't answer the question at all nor provide any evidence for your claim. Not to mention the previous form was nearly exclusively mocking other posts. – enderland Apr 28 '18 at 23:30
  • 1
    I answered the question in my first sentence. Don't forget the question - as so many here - was almost certainly about an invented situation. – Laurence Payne Apr 29 '18 at 12:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.