I work as a software developer on a team of 4 people for a community outreach organization. The network security is poor but upper management is aware of it, and we're planning to switch to a better IT service provider.
One of the employees, let's call him Bill, has repeatedly done things that comprise network security for employees and clients and openly talks about it with other team members. Before I continue, I found this question, but it's about a data leak, Bill hasn't uploaded any data anywhere, he's accessing areas of the network that he shouldn't.
- We were each given a laptop with all the required programs, and if we needed anything installed we had to talk to the manager to who would notify IT, but Bill brought it his own laptop (which is forbidden by company policy) and was caught, he told them that during his break he does online classes (which is true), so the manager let it slide, but because I sit directly behind him I see him do a lot of foolish things, he connected his laptop the the company network, and accessed network drives of the employees.
- Using a LiveCD with Ubuntu, he managed to enable the local admin account (IT created it for emergencies) on his company laptop and installed software that he shouldn't have.
- We allow students and people in the neighborhood who don't have access to a photocopier/printer or fax to use ours, sometimes they photocopy drivers license or other personal documents, Bill was able to remotely access the receptionist computer (the photocopier/printer is connected to this computer) and view certain documents that have been copied or e-mailed, some of which should have remained confidential. We have rotating receptionists, who are sometimes busy, so they don't clear the printer history or delete the files that we're scanned in, but all of it is cleared when the computers shutdown for the night and rebooted (any file on the desktop or in folders are removed). This leaves a windows of a few hours which Bill utilizes.
The rest of the team is aware but simply turns the other way, one of the members told me they're hoping Bill is handled accordingly without direct involvement of the other team members, they don't want to be labelled a whistle-blower.
Our team is close, so how do I report him without damaging the relationship/trust I have with my other teammates?
Edit: I made a mistake, Bill and Bob are the same person.