Fired for doing disallowed web searches; how can I show it was outside my control?

Question

My employer found that I had been conducting certain prohibited web searches on my work devices, and fired me.

I had no screen locks or passwords on any of my work devices - and didn't know I was supposed to have them. So it's possible anyone could have got on them, without my permission. I know for sure I didn't do those searches myself. To the best of my belief, I never let anyone use my work devices, for company policy said it was illicit or inappropriate use.

How can I prove whether the websites showed up on work devices because of a browser sync, and not because they were actually searched from that device?

Answer 1

The only real advice anyone can give you is to contact a lawyer and see what they say.

You do have a basic responsibility to keep work devices and data secure, so not password protecting them is fairly irresponsible of you.

In future, keep your work and home devices separate. Don't sign into your personal stuff on work devices and vice versa. Always lock your devices when you step away from them to prevent others from using them without your permission. And don't ever search for porn, drugs or anything else which could be possibly frowned upon on a work device or on the work network.

Answer 2

Someone else was probably on your machine

In a lot of employment contracts, you are considered to be responsible for anything done under your corporate account/devices even if you yourself weren't at the keyboard.

It is unlikely that this was caused by syncing your Google Account with Chrome. Chrome has a tendency to identify what devices conducted what action. Plus the ability to synchronise histories would prove that the History data can be altered, and thus would typically not be trusted for the firing of an employee. Regardless, this was still a bad move.

What probably happened is that actual attempts to conduct those searches by your account and/or devices was picked up by network security devices as it was being performed. You'll notice I said 'by your account and/or devices' and not 'by you'.

In a lot of places, you'll see a culture for pranking people who leave devices unlocked. Most of the time, this is just a harmless 'beers are on me email' but more juvenile/malicious people may do things that stir up a bit more trouble, unaware (or possibly fully aware) of what their actions might bring.

I had no screen locks or passwords on any of mine or work devices. So it's possible anyone could have got on them, without my permission. I never even knew I was required to have screen locks, not did I care if people used my devices.

Locking your devices and accounts should not be something that needs to be spelt out. It should be, and needs to be from this point on, common sense. Your devices likely hold a lot of company-sensitive information. What if someone got onto your machine and accessed something they shouldn't have access to? What if someone trespassed into the building and got access to your computer? You could have been potentially looking at a lot worse than just getting fired for inappropriate searches.

Answer 3

Note: this answer is written in less than optimal circumstances (31 December...) so I will be back with edits when time permits. Do not hesitate to suggest changes or edit them yourselves.

From the perspective of someone working in information security, your situation is not uncommon.

First - anything mentioned in the answers (mine included) must be put in context of the country you are in. You may be in a place where anything you do is company property and you have zero expectations of privacy - up to places where your private activities on a company device are protected.

This also covers the case of your responsibility when using your device (except for gross misconduct): from places where you are responsible for protecting your devices yourself and take responsibility for that - to places where your liability is limited and the burden of the protection relies on the company.

You need to understand this context of yours first.

---

In the text below "we" refers to "the company" and "they", to the employees. It is centered around the case where they claim they "did not do it" but we believe they "did".

We have systems which record activity of employees (please keep the legal context in mind - in some places this is fine, in other not, in yet others nobody cares whether this is legal or not, and in yet another nobody cares to record).

We would present the employee evidence of their activity (with the "go" from legal/HR) in the course of the interaction with them. This evidence would show that user ABC did XYZ at time TTT.

Please note that we just know that the user ABC, as registered in our systems, did something. This does not mean that the actual human who is normally associated with the account ABC did it.

There are many cases where ABC does not match the human:

• we were hacked and someone used account ABC for that
• an administrator acted as ABC
• someone used ABC account when the human was not at the keyboard
• someone saw the human typing their password and later that someone connected to ABC account
• ... and plenty of other cases

These are all reasonable claims which can be done - not to counter the evidence, but to challenge the link. (the evidence can certainly be tempered with in some cases, and this is also something which can be investigated)

It can be that we/the authorities prove that the human was the one using account ABC. Case closed.

It can be that we see that the human was not using the account ABC. In that case we need to determine whether

• it is their fault (did not lock the device while explicitly asked to - for instance)
• or not (the company was hacked, they were tricked into an action they could realistically fall for ( we are all humans), ...)

As you see such cases are not obvious and, sure, there are the easy cases (which end with eyes rolling or jail) but a lot are not that obvious. They often land in the gray zone, especially in places which are either not clean-cut in terms of company vs. user responsibility, or extremely specific and then the employee and the company have a ping-pong game of "it is your responsibility", "no, it is yours".

To be honest, I have a hard time understanding your question which jumps from "I have no password on my device", to "I let everyone use them", and to some kind of sync between searches. If I may recommend to clean that up (and stick to facts - and their consequences), I would be glad to comment further

Have anxiety and never read the pop ups

Please do, this makes everyone's life easier and more secure.

Answer 4

The issue is the policy itself.

Either you hire self motivated employees, and give them meaningful work, or any other policing effort will be waste.