How do I report an employee who is compromising security of employees and clients?

Question

I work as a software developer on a team of 4 people for a community outreach organization. The network security is poor but upper management is aware of it, and we're planning to switch to a better IT service provider.

One of the employees, let's call him Bill, has repeatedly done things that comprise network security for employees and clients and openly talks about it with other team members. Before I continue, I found this question, but it's about a data leak, Bill hasn't uploaded any data anywhere, he's accessing areas of the network that he shouldn't.

Example(s):

• We were each given a laptop with all the required programs, and if we needed anything installed we had to talk to the manager to who would notify IT, but Bill brought it his own laptop (which is forbidden by company policy) and was caught, he told them that during his break he does online classes (which is true), so the manager let it slide, but because I sit directly behind him I see him do a lot of foolish things, he connected his laptop the the company network, and accessed network drives of the employees.
• Using a LiveCD with Ubuntu, he managed to enable the local admin account (IT created it for emergencies) on his company laptop and installed software that he shouldn't have.
• We allow students and people in the neighborhood who don't have access to a photocopier/printer or fax to use ours, sometimes they photocopy drivers license or other personal documents, Bill was able to remotely access the receptionist computer (the photocopier/printer is connected to this computer) and view certain documents that have been copied or e-mailed, some of which should have remained confidential. We have rotating receptionists, who are sometimes busy, so they don't clear the printer history or delete the files that we're scanned in, but all of it is cleared when the computers shutdown for the night and rebooted (any file on the desktop or in folders are removed). This leaves a windows of a few hours which Bill utilizes.

The rest of the team is aware but simply turns the other way, one of the members told me they're hoping Bill is handled accordingly without direct involvement of the other team members, they don't want to be labelled a whistle-blower.

Our team is close, so how do I report him without damaging the relationship/trust I have with my other teammates?

Edit: I made a mistake, Bill and Bob are the same person.

Answer 1

In theory, when you talk about such things to your manager, or IT or HR or whoever in your company is responsible, it's their obligation to not mention your name to the person you're reporting about. Whether they will actually stick to that... only God knows. So, it could happen that you do everything by the book and that the manager still tells Bill that you accused him of something.

The best regular approach would be to stick to things that are outright illegal and cannot plausibly be defended. For example, having a local admin account on the laptop he uses anyway, and installing stuff on it, as long as that stuff is something actually needed for his work, is rarely critical, and a lot of companies will ignore that. Heck, I do it sometimes, when I know that IT will take a month to do something I can do in a day. But that's for software that's actually needed or useful for the company projects I work on.

(Of course, if he installs something unrelated to work, that's a different story)

But on the other side, copying people's personal documents, ID stuff like drivers licenses and such... is quite possibly illegal. That's something that the management should do something about.

A non-standard solution, but it could perhaps work, wold be for the company to offer Bill to test the new IT service provider - try to hack stuff and get a monetary reward for each successful hack that he reports to the company, that gains him access to files he shouldn't be able to see. In that way, well... "if life gives you lemons, make lemonade". Use him for what he's good for. He gets to play the way he wants, the company gets better security (by finding holes and then asking the IT provider to patch them), everybody's happy.

Answer 2

You should consider both talking to your colleague and alerting your manager, or the organization's cyber risk manager. Cyber risk is a serious concern of any reasonably informed organization.

You'll risk your relationships with your colleagues by handling the situation unprofessionally or indelicately, not by reporting your concern alone. Keep the following in mind and you can expect to maintain the respect and trust of your colleagues:

• Don't discuss your observations with anyone except a trustworthy manager and your colleague that you've observed creating security issues. This isn't a topic to be used for gossip or banter among your teammates or at home.
• Do have a frank but friendly discussion with your colleague about your concerns. Make sure they understand you're genuinely concerned about the wellbeing of the firm. Be upfront about having alerted a manager.
• Do give your colleague the benefit of the doubt. It's reasonable to assume he/she really doesn't understand the riskiness of his/her actions. Focus on your specific observations - don't make judgements about the person.
• Don't nit-pick. Identify and report big issues. It's okay to let some things go (e.g., installing Spotify on a company laptop against policy). Leave monitoring to the IT team.
• After reporting, let it go. If the appropriate individuals in the organization don't intervene to correct the issues, let it go. You've done your part.
• Listen to the feelings and feedback from your colleague and the rest of the team. At minimum, your colleague will be embarrassed. Don't lecture or chastise. Listen to what your colleague has to say, apologize for any hurt feelings, and let him/her know that you enjoy having him/her as a colleague and want to keep working together.

Answer 3

Let’s be honest, you can report Bill anonymously but you work for a small organization. I would expect word to get around. I would document your concerns and take it up the chain of command. Bill is not a team player.

If coworkers ask you to explain why you reported Bill you are under no obligation to explain. If you choose to explain a simple answer like he seriously and repeatedly endangered network security should suffice.

Bill is putting himself above the organization. You should not protect him.

Answer 4

I work in cybersecurity as an security analyst / engineer. I will start by expanding on one of the points that Jay brought up in his post -

First do not assume actions by Bill are malicious.

From my experience in researching and managing security incidents on the security operations team at my company, most incidents occur not because an employee has malicious intent, but because employees are not provided the appropriate tools for them to do their job efficiently, or due to ignorance of the employee in what the risk of their actions is in terms of liability for company.

Going to management and assuming Bill has malicious intent most likely will not end well. From your post, you appear to have some knowledge of network security which is great. Therefore discussing your concerns with Bill and explaining the risks of his actions to the company is a good first step. Let it be known that some potential consequences of his actions are not in his best interests. For example,

• Plugging his own machine into the company network ports may spread malicious software onto the company's IT resources. If the company IT infrastructure goes down, he may not be able to complete his work or continue to take his online classes any longer.

You did not ask for this, but I will share with you some cybersecurity best practices, that as you company continues to grow, should mitigate the negative effect of Bill's behavior.

Suggest to your management that policies and guidelines be established and documented as to acceptable use of company IT resources

It is currently not clear whether your company has policies documented such as to acceptable use of company IT resources, or security incident response. The benefit in having standarized policies is that employees feel less of being the "bad guy" and picking on a colleague, but simply adhering to company policy. In other words, whatever is "reported" become a whole less personal. One is simply doing their job.

Another benefit is that expectations for secure behavior are made universal and known to all employees. Security is no longer a "guessing game" and enforcement of secure behavior becomes less arbitrary. Employees know what is expected of them, so responses such as "I did not know what the policy is" becomes less credible. The tone of security must be universal throughout a company, or cybersecurity becomes a meaningless phrase.

Suggest implementation of a security incident response plan, and to go hand in hand, an IT resource monitoring plan

Right now, it seems there is not a definitive, documented procedure for how to respond to Bill's observed actions. This seems to be driving your indecision on whether or not to "report" Bill to management. In other words, you don't seem sure what the effects of reporting Bill may be.

I know your team is small and it seems your company is small too. However, as it grows, the benefit of having a documented security incident response policy is that there is a consistent, transparent set of procedures for how reported incidents are handled, and what qualifies as a security incident.

To go hand in hand with the security incident response policy, suggest implementation of a resource monitoring policy. You said Bill did not leak any company data, but how can you really be certain he did not without a monitoring process in place, such as through DLP technology? Bill could easily deny his actions without objective evidence such as audit log data. Even worse, if you need to terminate Bill or take legal action against him in court, the defense would most certainly question how you knew Bill was the person who leaked the data. Without evidence, what are you going to do or say?