Major red flags :
restricted access area.
Unless stopped immediately, this may not end well for anyone – quite possibly you included.
We are not required to work unpaid overtime
So, why do you? If you are not allocated sufficient time for your work, then this could be bad project planning, which ought to be discussed with management.
The company has official rules for being in the office during after hours, requiring any employees to report their presence for insurance and security reasons
Do you follow these when working unpaid overtime? If not, you could be in trouble too. Although that does not matter too much, as you are almost certainly breaching the terms of your contract of employment (not to mention the Official Secrets Act, or equivalent) by not reporting a security breach.
But those other guys are certainly in trouble (and, where I work, their girlfriends would receive a severe grilling from organizations with three letter abbreviations).
This behavio(u)r could lead to:
- Loss of security clearance, greatly restricting future career prospects
- Possible criminal prosecution, possibly leading to imprisonment
If you don’t want to appear the bad guy, tell them that on a night when you worked overtime alone, security came by for a check-up. Heck, tell them what you want, even if you have to threaten to report them. Hopefully, though, pointing out the possible consequences will be enough to bring them to their senses.
Your colleagues may think that this is “no big thing”, but I can assure them that government agencies think otherwise.
[Update] You also said
She will sit next to him without talking, doing stuff on her computer for hours until they leave
If she is using the company LAN, then she is leaving footprints. Depending on your location (maybe add a tag?) and the nature of what she does on the LAN this could also be a big deal.
In some countries, whatever you on a company server belongs to the company, so they can legitimately access logs and all traffic which passes through their servers. (I have known a company read and print out an employee’s Gmail). In other countries they are not permitted to associate site visited with employees visiting them, hence almost ubiquitous “work related only” filters. I would imagine that if they were a government organization, they could in any case be exempt from such a law.
This leaves two potential problems:
- The girlfriend is surfing something illegal or politically subversive, which might trigger some alarms
- Maybe she is just using a lot of bandwidth for NetFlix or the like
In either case, her surfing, if any, even if it stops now, may eventually become apparent to a sysadmin and be reported up the tree. Maybe not, but it’s just another worry here. Btw, this should be obvious, but I hope that no one is posting anything to social media indicating that these girls are visiting the office.
OP's account no longer exists, so we will never know how this turns out - bt it didn't end well, that's for sure.