Is it appropriate to make known a colleague using company's resources for personal use?

Question

At my workplace, the company has trusted us with full access to its Cloud infrastructure service account (think of Azure, AWS, etc). The belief is for developers to have access to what they need fast for development. Recently, I happened to stumble upon something and discover that a colleague on my team is using the company's Cloud service account for purposes related to his personal project. I've found out that he uses the resources in the company's Cloud service account during and after working hours for his own project.

I asked that colleague about what he was doing with those resources in the Cloud service account. He vaguely replied that he was doing something which sounded something related to the project we work on but it was clearly a lie because the code he is running isn't doing what he said. When I looked at the code he ran, he appeared to be running something related to his personal project which I could see was pulled from his public Github account.

The cost of these Cloud services are based on our usage. The cost he has incurred on the account is not significant enough yet to alarm anyone as our monthly bills for Cloud services are huge. So nobody is likely going to notice that.

I'm having the urge to tell this to my manager because I feel that this is ethically wrong and he shouldn't be doing so. However, I don't know how my manager will respond. From my experience working with this colleague, I find that he has issues with being honest and he might be able to lie his way out. The last thing I want is for my manager to think I'm being petty over it or start judging that I was too "free" at work to check on my colleague or even think that I should support my colleague doing his personal project. If my manager is going to confront him, things can get awkward between us too.

Rationally, the cons of telling my manager outweigh the pros. After all, it's not my money. I could pretend I don't know anything about it. It feels like I saw somebody stealing and I kept quiet about it, and I don't feel good about it because this is unethical.

Is it better for me to turn a blind eye or should I inform my manager?

Answer 1

You have multiple unknown factors:

• You don't know what the colleague and their boss might have discussed about an upcoming requirement, for which they might be doing a PoC.
• You don't know whether any separate work allocation was made to that person for carrying out some work other than the "official" (i.e., known to the team) work.
• You don't know whether there's any separate understanding between the employee and the organisation regarding the usage of those services. They might have simply obtained permission to use those resources, for a limited amount of time / cost.

Given that, in this case

• The usage you noticed in not actively harmful
• and, you're not responsible for overseeing the fair usage of the resources

I'll advise to let it pass. It's probably too small a thing (as you're already mentioned) to be bothered about.

---

UPDATE: OP is the team lead and is/ should be aware of all the current and upcoming requirements

Well, in that case, it's a different ballgame.

• You're in a position where you reside in a higher position in the reporting hierarchy.
• You asked them about the usage and requested clarification, and they lied.

This is more serious than simply using some of the resource for R&D / personal project. This is stealing and intentionally twisting the facts. If nothing else, the employee morale is questionable. You should

• Report your observation to your manager (and the IT/InfoSec compliance department, as applicable or advised by your manager).
• Include a description of your conversation with the person and how they actually tried to mislead you.

Answer 2

1. You are his team lead and he lied to you. There are suspicion that employee uses enterprise resource to his own without approval because he lied.

2. The company resources used are affordable. Cloud training is expensive and employees with hand-on cloud experience are usually effective.

3. There are some risks since cloud usage can generate surge that are expensive and there is a lot of people lurking to get access to cloud resources like scanning keys inside of repositories.

4. There may have issue about copyright due of company resource usage

Could it be possible to get the appropriate authorizations to get a win-win situation?

• validate with management it does not set a precedent
• get the employer position about the usage of company resources and copyright attribution
• share concerns about security, brainstorm how set security and cost boundaries

Q. Is it better for me to turn a blind eye or should I inform my manager?

Personally, for the first offense, I would not warn the manager. I would seek the appropriate authorizations like:

Hey boss, can we use cloud resource to accomplish some personals projects without bugging people with copyright issue? This will improve employees motivation and they would get more experience but there are security and financial risks related to it.

Then, I would meet 1-on-1 the employee near the coffee machine and discuss with him:

Hey coworker, I felt your project was personal but it cool that you are working on some stuffs outside of the office. Do you want to tell me more?

If the employer gave green light, then:

The company policy is OK with that. We would like that everybody is transparent about the usage of company resources. I am not a lawyer but in your position, I would check about copyrights. Also, do you have any ideas to set the security and cost boundaries to avoid surge or being hacked?

If the employer position is a no, then:

The company policy prohibit the usage for a personal projects because there security, financial and copyright risks attached to it. You can loose the copyrights of your stuff by using the employer resources.

If there is a second offense after this talk, I would report it because he know that you know that he know that the employer do not accept this behavior.

By doing this, you strength your position as a leader by avoiding drama, that it is possible to discuss issues without involving hr or management, increasing chance that people will be more honest with you and other peoples come to you about other issues related to company or management.

Answer 3

I never really managed anybody myself, but I think what I would do in this case, as the manager of this person, is giving him one last chance to explain himself. I would do this by planning a meeting with him, explain my findings and suspicions, and wait for his answer and explanation. In case of normal use, it wouldn't need to go much further than that, I would probably even "excuse" myself for being so suspicious.

In case of a proven miss use, I would ask that it ceases immediately anyway and report to my upper management. This is not only about money, it could be also a threat to your company (what if this activity is actually illegal? Are you sure there could be no IT security threats with this?) or simply to you (what if somebody notices and somehow learns that you were aware of this?) Also, if you can not trust this employee on that, on what can you trust him?

I can think of another possible option where I actually decide to trust him and "let go for this time" (assuming it ceases right away of course). In this case I would anyway give him a serious talk insisting on how this is unethical and why I'm actually ready to take that risk for him. Reasonably speaking, I wouldn't advise to go that way but I know I've worked with people I would have taken the risk for, because I was convinced they were worth it.

Answer 4

The simplest way to approach it is to take an interest in what is being done. As a lead it is not unusual to be engaged in what developers are doing in general, for example in order to share knowledge between team members and increase the teams resilience. Frame it as an opportunity for praise for the developer doing company work outside of company time! (Just remember to keep a positive tone, not an accusatory one).

Asking a few more probing questions shouldn't be seen to be a problem, and if the answers are overly vague, or not clearly showing to be a benefit to the company, question if the managers (and specifically which mangers) are aware of the company resource usage. As from what you have mentioned it seems clear that they are using company resources, and this should have been cleared with management before hand.

If the person has cleared it with a manager, then double checking with a manager will be a simple and painless task, how ever it they have not been then it is likely the person will either stop, or be asked to stop by management when it is brought up. This can be framed as a learning opportunity to clarify the line between personal usage and company usage. If the person is being truthful about it being connected to work stuff then it maybe a case of them not being upfront and asking before hand, rather seeking to prove benefit of the work to the company and then getting retrospective praise.