14

My Boss requested from IT to change my corporate password while I was out of office without telling me. He used the new password to log on my PC as me and copied my project (I don't know what else he did).

When I was back in office, a yellow sticky with the new password was on my desktop. He told me that is my new password when he saw me in office. Is this violation of security? A privacy breach?

closed as off-topic by gnat, carrdelling, Lilienthal Apr 26 '18 at 8:56

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking advice on company-specific regulations, agreements, or policies should be directed to your manager or HR department. Questions that address only a specific company or position are of limited use to future visitors. Questions seeking legal advice should be directed to legal professionals. For more information, click here." – gnat, carrdelling, Lilienthal
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    Was logging in to your PC as you the only way to access the project files? Was there something else your manager could/should have done to get a copy of the project? – Patricia Shanahan Apr 26 '18 at 2:35
  • 3
    Ethical? No. Good IT policy? No. Can he do it? Yes. And there's not much you can do about it. – Slothario Apr 26 '18 at 3:01
  • 16
    What is your location? This varies based on location. – Erik Apr 26 '18 at 5:05
  • For security questions see Information Security. For legal questions see Law. I'm not seeing an answerable/practical question in this post so I'm putting this on hold. Please check help center if you want to ask a question for this situation that we can answer. – Lilienthal Apr 26 '18 at 8:56
  • 1
    "Is this violation of security? A privacy breach?" No and no, most likely. This is not uncommon in emergency situations (coworker MIA or sick) and has not stored project on network shares or in version control. – pmf Apr 26 '18 at 11:25
27

You should not expect to have privacy on a company-owned machine. However, in a healthy IT environment your manager would do this by asking IT to send him the files he's looking for, which they can retrieve by accessing the computer using their own administrative accounts, not by accessing with your account. If they do it this way, there is never an auditing question of who accessed the files, or whether an action taken by your account is actually an action you took. Your IT department should also follow any guidelines they've been given to facilitate the access - this might include getting permission from your company's legal counsel, providing justification documentation, etc.

Whether or not this is a security violation depends on company policy and applicable law/contractual obligations. You can bring this up with your manager if you want and voice your concerns, and there are quite a few valid ones. As mentioned, logging into your account directly defeats auditing - your security team can no longer be reasonably sure actions taken by your account were taken by you if other people log into the account. Depending on your job, you may also have access to information your boss does not - this could include HR-related information, client data for contracts your boss is not on, and so on. However, changing the system to allow for this kind of access may not be considered a worthwhile investment for a small company that doesn't handle sensitive information.

Also, as Edgar mentioned leaving your password out on a sticky note exacerbates the auditing issue, since now anyone in your company could have accessed your account while you were gone. At the very least, if the company is unwilling to change their policy on resetting accounts, you should ask your manager to tell you the password in person when you get back in the future, or have IT reset it again to something generated by a secure random password generator and don't write it down, then reset and allow you to pick a new password when you get back.

  • 16
    This is culturally related. The culture here (Belgium) is that while you're of course not given a free pass to store whatever you want on the computer, there is still an expectation of privacy. A court ruling was made, declaring a personal email archive and a book the employee had been writing (out of office hours) as private. Compare it to getting a company locker. It being a locker (= secured account) implies privacy. While you don't get a free pass to store anything in there (e.g. no CP or depleted uranium), that doesn't mean people can force their way in without reasonable cause. – Flater Apr 26 '18 at 7:24
  • @flater: can you provide some meta info about that ruling (link?)? I would love to know more about it! – user189035 Apr 26 '18 at 7:57
  • @user189035 Here (in Dutch). (1) Employers cannot monitor employee behavior on the computer without express permission of the employee (2) When monitoring, only activity can be monitored, not the content the activity. E.g. if your job entails surfing the web, monitoring cannot distinguish between surfing on or off the job, only that you are surfing. (3) Privacy restrictions apply to any file that is placed on the hard drive by the employee. (4) It is forbidden to track which sites were visited. – Flater Apr 26 '18 at 8:15
  • @user189035: It also mentions that there is a "higher importance" loophole here though. Courts will consider Facebook usage as a privacy violation and will not accept it as a valid reason for employment termination; but surfing for child pornography will be not be considered a privacy violation due to the higher importance of the crime over the employment contract. In other words, these rules can be lifted for issues that surpass contractual employment violations and drift into the territory of a felony. ("Risk of malware from bad sites" is explicitly denied as a "higher importance", btw) – Flater Apr 26 '18 at 8:17
  • @Flater: Thanks for all this info! But do you have a pointer to the ruling itself. I'd like to have also a reference. – user189035 Apr 26 '18 at 8:53
19

The "yellow sticky notepad with the new password left on my desktop" is definitely a violation of security and the boss of any company should know that.

He might have a reason that he has to access your PC and he might have a reason to ask the IT to reset your password. But it is inexcusable that he put that new password in the open. He should have informed you that he had to reset the password and then IT could have reset it again and give you a new password - which your boss does not know.

Edit: About using the user account or a different account: Yes, IT should be able to get data from that PC using a different account. But in real life it is often just so much easier to logon with the "normal" user account. I think that is a question of company policy and the circumstances and not easy to answer.

  • 3
    I am wondering why the downvote? (I actually upvote this because I think the answer is correct). – scaaahu Apr 26 '18 at 3:32
  • Better yet, IT should have been able to log in using a different account. – Erik Apr 26 '18 at 5:06
  • This answer assumes that passwords in this company are strictly adhered to. In my old company the computers were basically part of a shared infrastructure and the passwords were just to help managers identify who was using which computer at that moment (so that they could use PCAnywhere to screen-view accounts that were raising issues). There was zero expectation of computer privacy and auditing wasn't an issue. – Richard Apr 26 '18 at 6:21
  • 1
    @Richard In your old company, did the password enable anyone to log into the computer? If a janitor saw the yellow sticker in the evening, can the janitor use it to get into the company infrastructure? – scaaahu Apr 26 '18 at 6:30
  • @scaaahu - Serious infrastructure stuff (personnel records and the like) wer further restricted (to company seniors) by a second passworded folder – Richard Apr 26 '18 at 11:33
2

The legal implications will depend on the country. In France for instance that would be a terrible thing to do as you are allowed by law to have personal data on your computer. Please note that I am writing terrible thing and not illegal thing as he may still access your professional data as he seems fit.

Then comes the question of traceability. From the moment he got your password to the moment you changed it he is in responsible of whatever happened with your account. In particular if you do not change your password he is still you. You may want to specifically document that.

From an information security perspective (something I can comment on first hand), such an action shows that your company does not have sound security policies. This may or may not be an issue, depending on the industry you work in.

Not the answer you're looking for? Browse other questions tagged or ask your own question.