0

I work with the government. Sometimes we work with sensitive private data to find clues about tax crimes.

Now there is this one new colleague of mine who is too nosey, he is looking into data that has no tax related information and I wouldn't be surprised if some of that data, which he found particularily interesting, "somehow" leaked into the internet.

I recently subtly tested his knowledge required for the job and it turned out, that his knowledge about tax law and other requirements was subpar. I talked to my supervisor about this but he said, that everything was fine about him.

Nothing is fine about him. I have never done anything illegally tax-wise, but if tax investigation came to my house and seized my dvds to find something illegally tax-wise, I am sure I would find videos of my wife and me on our wedding, bank statements, or credit card information leaked on the internet if he was to review the "loot".

What should I do?

Improve this question
9
  • 4
    why do you think he would leak it? Have you any proof? – Kilisi♦ Jan 5 '19 at 21:43
  • 1
    @Kilisi its still a very serious offence gross misconduct at best possibly a breach of other laws as well - the official secrets act comes to mind for the UK. – Neuromancer Jan 5 '19 at 22:24
  • @Kilisi How would you prove it? – Glenn Link Jan 6 '19 at 3:13
  • 3
    The worst thing I see here is your statement that "I wouldn't be surprised if some of that data, which he found particularily interesting, "somehow" leaked into the internet." - that itself could be cause for disciplinary action against you in some companies! – Rory Alsop Jan 6 '19 at 20:26
  • 1
    It seems you are correlating incompetence with ill intent, but I see no reason to assume the latter even if the former is true. "I wouldn't be surprised if" is not a substantive claim, it's a hypothesis. Is there any evidence to back up your hypothesis? – Flater Jan 8 '19 at 7:36
10

There’s three separate things here, which should be dealt with independently...

  1. Your corporate systems should be restricting or recording access to personal data by users, so if they’re not, that needs highlighting.
  2. If the colleague is misusing his access, that should be flagged to the appropriate people, which might be your line management or a security team, for review.
  3. The claim that your colleague would post information they found is extremely serious but as presented is completely unsubstantiated, so needs some evidence of at least intent before this should be raised.

Basically, there should be routes to raise concerns within your company - use them if there are specific concerns or actions to raise but be sure that there’s a reasonable concern, as your suggestion that they’d post information to the internet is, on the face of it without any evidence, suggesting that this is just your prejudice against your coworker.

Improve this answer
4

You must have clear procedures and reasons to flag co-workers in place.

Other than that, you're in no official position to evaluate your colleague, their qualifications or work !

Should you see another infraction to the company policies report it according to the sanctioned procedures through the proper channels in writing to leave a papertrail.

You've done your due diligence, otherwise
KEEP YOUR NOSE IN YOUR BUSINESS.

... and please don't utter unsubstantiated, wild speculations.
You sound like you've seen one too many conspiracy theory videos online.

Improve this answer
8
  • An Ok answer but in terms of breaking this sort of company rule or the actual law isn't much of a defence if it came to an investigation. – Neuromancer Jan 6 '19 at 0:28
  • 7
    Having worked for government, we're taught not to turn a blind eye to coworker's suspicious behaviors, because of insider threat. You could be implicated if the coworker stole sensitive information and the authority discovered you were aware of the coworker's actions, but didn't properly report it. – jcmack Jan 6 '19 at 12:34
  • 2
    @jcmack makes sense.I did say to follow company policies and report accordingly and to follow the laid out procedures and proper channels. He still isn't in a position to EVALUATE his colleagues QUALIFICATIONS, WORK or SPECULATE on what he could do unless that is part of the policy.Especially since his manager told him everything is fine.Regular work behaviour still applies presumably... – DigitalBlade969 Jan 6 '19 at 13:56
  • 1
    @Neuromancer why are you guys telling me things I agree with and included in my answer?please read more carefully!I said follow official policies and procedures.Despite having strict security policies they still have hierarchy and workplace etiquette.Or is everyone authorized to evaluate everyones professional qualifcations and work?On top,OP is wildly speculating about potential actions that have no merit in his observations.OP reported his suspicions,which was correct and I said to continue to do so.Even OPs supervisor shot him down.OP better do HIS work,not overstep policy and hierarchy. – DigitalBlade969 Jan 6 '19 at 21:11
  • 3
    @DigitalBlade969 I agree that OP shouldn't be calling his coworker's skills into question, but this statement to me is unnecessary: "You've done your due diligence, otherwise KEEP YOUR NOSE IN YOUR BUSINESS." I've interviewed with the 3 letter agencies and they specifically screen out "people who mind their business" because you have to be vigilant of spies and other nefarious activities even within your own organization. – jcmack Jan 7 '19 at 5:37
2

Assuming your security is set up correctly this maybe caught by audits and being caught like this is going to be instant dismissal and possibly for his manager.

Did you actually mention to the supervisor what your coworker was doing?

I would suggest an anonymous tip to your security team - don't use email use post and don't print it out at work.

Improve this answer
1
  • 5
    In fact, don't print it out at home. Use a copy shop. – bytepusher Jan 5 '19 at 21:55
1

I talked to my supervisor about this but he said, that everything was fine about him.

Then let it rest (after getting it in writing, of course).

It is not your job to know better than your boss, so you have to accept what he says (or leave).

However, if you do have genuine concerned, then you should (have) send an email and get a response.

Be sure to state in the email that you are concerned that you might be "guilty by association", which sort of forces the boss to either do something, or tell you in writing that you are ok. Keep sending the email until he does one of these two things - then don't raise the matter again.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .