Caught someone's salary receipt open in its respective personal webmail in someone else's computer. What to do?

Question

I just stumbled into something that is both bizarre and confusing, and I'm not entirely sure what to make of it.

I'm an IT technician. I sat down on employee Alex*'s desk, after hours, responding to a request for support from Alex's manager (Charlie*) about that computer's performance. All people mentioned were not in the office at this time, by the way.

Alex's computer was left on, with the user logged in and unlocked. The web browser was left open on employee Blake*'s personal webmail page, more specifically in an email with Blake's latest salary receipt.

I'm unsure what to do with this information. On one hand, it's not my responsibility to make sure personal email accounts are secure, and I'm also not absolutely sure that there is something nefarious going on or if there was consent.

On the other hand, this ends up intersecting with the business since the salary receipts are involved, and in spite of that, I also feel like I have a moral obligation to do something about this given that it seems extremely likely that there is something nefarious going on.

Their relationship is distant, as far as I can tell, but I don't know either too well. They don't interact a lot because their functions don't intersect too much. They work in different offices, different departments, but in the same floor. Neither is in a position of power or influence, and there's no hierarchy link between them. It's at least possible that there might be more to this beyond the office, but it's unlikely. Plus, even if Blake wanted to show their salary receipt to Alex, for whatever reason, it doesn't make sense to provide access to their personal email account.

Some more context:

The users' expectation is for us to log in with an admin account, otherwise we schedule support with the user. I don't know if the user knew about the timing of the intervention, since the request came from their manager. Plus, this user always leaves the computer on.

Also, the user session locks after some time, so leaving it unlocked may not be surprising if the user relies on the timeout. Since I started working on it right after they left, it just happened to not lock in time.

The sensitive information left on the screen suggests to me that the user wasn't thinking about my intervention after hours.

---

*Names fictionalized

Answer 1

The computer was left on, with the user logged in and unlocked.

This is what makes it your business. Regardless of whether A hacked B’s email or B sat down and did something logged in as A, it is a security incident that needs to be reported.

It’s not your job to investigate it, but it is your job to document it and report it.

Also, you have an ethical obligation to not share information you may have come across inadvertently while performing your IT support services (except as needed to report the incident through proper channels) and you should not gossip or speculate about what may or may not have been going on.

Answer 2

TLDR: Report it as a security violation.

To break it down, there are three violations.

The computer was left on, with the user logged in and unlocked.

In almost every IT security policy, this is a no-no. Your computer should in the very least be locked.

The web browser was left open

Again, leaving browser windows open is usually a violation of most IT security polices.

more specifically in an email with B's latest salary receipt.

This is company information left unsecured. The fact that it's a coworker's salary information is not a mitigating circumstance, but an aggravating one, and again, is likely a violation. Having that information easily accessible due to an unsecured PC with an open webpage should be screaming "potential security breach."

Answer 3

On one hand, it's not my responsibility to make sure personal email accounts are secure, and I'm also not absolutely sure that there is something nefarious going on or if there was consent.

Explanations for this can be several, like, say, B asking A to use their computer briefly, A leaving the office and asking B to leave it on as you would later check the PC...

Anyways, don't assume or make up things and explanations for this; with that stance one can quickly start feeling "things are odd". Keep doing your work and focus on the task given (the PC).

What you can do without going over your role and responsibilities is to report or tell about this to someone. Telling A is one option, so they are aware that their PC was on and logged in... they can then tell you if it was on purpose or they know nothing about it...

You can then proceed to report this to your manager. Don't phrase it as "hey I saw A's PC being hacked or compromised", as you are not sure if it was on purpose, just stick to the facts (you found A's PC on and with B's user logged in). The email with salaries is also a bit superficial detail, what matters is that you found the PC on and another user logged in.

Answer 4

Log it -> Tell A & B assuming both knew -> Let them correct you if not

You should first log what you've seen. A left themselves logged in, security risk, with B's emails open, security risk, and payslip open, personal information risk.

Assume that what you saw was through some innocent means, B was checking their emails on A's computer or some such. With your security hat on talk to A and B together - telling them they shouldn't share computers like this and A shouldn't leave the computer on. If A had gained access without consent of B then B can point that out and escalate.

This way you're tackling what is your job, IT security, and providing the information to B to take action if necessary.

Answer 5

I cannot believe that there are people suggesting you do nothing about knowing that Employee A has access to Employee B's personal webmail. That approach is highly unethical and potentially problematic for you if there is a future complaint and you are found to have concealed information you knew. From the Company's point of view you were aware of a situation pointing to a possible security threat / dishonest employee and concealed it - if I discovered that as your Manager I would sack you on the spot.

I strongly suggest you speak to your Manager and they should handle it, likely with HR involved. If you are not comfortable with that approach then you need to speak to Employee B to find out of this was known or not before deciding what to do next.

Answer 6

Other answers deal with the direct question of what to do with the information now that you have it.

One option to avoid similar dilemmas in the future (assuming Windows-based PC) would be NEVER look at the screen before hitting ctrl-alt-delete - focusing on the keyboard and not the screen as you approach. Then all private information will disappear from the screen and you can safely look at it to see whether you've got a login prompt or need to select "switch user" to log in with admin credentials as a separate session (although you'd almost certainly have figured that out before that point even from peripheral vision).

If the user needs to be logged off for your tests, and you haven't already got standing permission to forcibly end the login session in such cases (potentially losing documents the user was still editing etc.), you could simply select the "lock" option (as the user should have done themselves when leaving the workstation unattended), and report back that user did not log out, so you cannot proceed, and/or seek permission from the manager to forcibly log that user out, potentially losing unsaved work. If the manager asks back "what were they in the middle of" you would then be able to honestly reply "I've no idea, the workstation is [now] locked".

It may then still be necessary to report the security incident, but an honest report along the lines of like "user was still logged in on arrival, I immediately locked the workstation without looking at it in order to protect any private information that may have been displayed" would seem a better position to be able to take than, in effect, "On arrival, workstation was unlocked, and I couldn't resist looking at the private information displayed on the screen - and indeed looking at it closely enough to determine that A's computer was logged in to B's private email with B's payslip showing", which is what your original question amounts to.

As others have pointed out, you can't now "unsee" what you saw, and there's a whole separate ethical issue about whether you had permission to check out what A had on their screen on arrival, and whether to admit to the privacy violation you committed if you did not have in fact have (implied) permission to do this, and again I'm not attempting to answer that part.

However, if respect for privacy is important in your environment, you may want to use that approach in the future - and importantly be seen to be doing it routinely when servicing unattended PCs that can be observed by others in the room or in nearby rooms. A "I didn't see what was on the screen because I do this as soon as I arrive" will stand up a lot better if you've been seen doing that on multiple occasions... you'll need to determine the right balance between what needs to be kept private at all costs and what should be noticed and reported at all costs for your particular environment.