42

I just stumbled into something that is both bizarre and confusing, and I'm not entirely sure what to make of it.

I'm an IT technician. I sat down on employee Alex*'s desk, after hours, responding to a request for support from Alex's manager (Charlie*) about that computer's performance. All people mentioned were not in the office at this time, by the way.

Alex's computer was left on, with the user logged in and unlocked. The web browser was left open on employee Blake*'s personal webmail page, more specifically in an email with Blake's latest salary receipt.

I'm unsure what to do with this information. On one hand, it's not my responsibility to make sure personal email accounts are secure, and I'm also not absolutely sure that there is something nefarious going on or if there was consent.

On the other hand, this ends up intersecting with the business since the salary receipts are involved, and in spite of that, I also feel like I have a moral obligation to do something about this given that it seems extremely likely that there is something nefarious going on.

Their relationship is distant, as far as I can tell, but I don't know either too well. They don't interact a lot because their functions don't intersect too much. They work in different offices, different departments, but in the same floor. Neither is in a position of power or influence, and there's no hierarchy link between them. It's at least possible that there might be more to this beyond the office, but it's unlikely. Plus, even if Blake wanted to show their salary receipt to Alex, for whatever reason, it doesn't make sense to provide access to their personal email account.

Some more context:

The users' expectation is for us to log in with an admin account, otherwise we schedule support with the user. I don't know if the user knew about the timing of the intervention, since the request came from their manager. Plus, this user always leaves the computer on.

Also, the user session locks after some time, so leaving it unlocked may not be surprising if the user relies on the timeout. Since I started working on it right after they left, it just happened to not lock in time.

The sensitive information left on the screen suggests to me that the user wasn't thinking about my intervention after hours.


*Names fictionalized

17
  • 1
    Clarifying question. Was the computer left on so you could access it and check the performance they asked? Or usually people leave it shutdown and you later turn it on and access some admin account to run the performance test? – DarkCygnus Jan 18 at 17:44
  • 2
    Yes, the expectation is for us to log in with an admin account, otherwise we schedule support with the user. I don't know if the user knew about the timing of the intervention, since the request came from their manager. Plus, this user always leaves it on. Also, the user session locks after some time, so leaving it unlocked may not be surprising if the user relies on the timeout. Since I started working on it right after they left, it just happened to not lock in time. The sensitive information left on the screen suggests to me that the user wasn't thinking about my intervention after hours. – Smig Jan 18 at 18:17
  • 3
    @ChrisH The culture in this company is fairly relaxed on security. There is no policy that enforces manually locking the session, and the policy explicitly allows users to check their personal email accounts - with the general caveat that they can't do so if it interferes with the employee's functions. In practice, I'm used to finding the sessions locked because it is encouraged and due to auto-lock features, but the user can't be at fault for that in this particular environment. – Smig Jan 19 at 11:24
  • 1
    @ChrisH, I think you might have missed the point that the personal email account that was on screen belonged to someone else, not the user who OP was trying to help. So OP went to User A's desk, and found that user A was logged into User B's personal email. – DaveyDaveDave Jan 19 at 12:27
  • 2
    @DaveyDaveDave But given that the PC was not locked, anybody could use ist (perhaps B wanted some info immediately and A's desk was closer) – Hagen von Eitzen Jan 19 at 16:46
102

The computer was left on, with the user logged in and unlocked.

This is what makes it your business. Regardless of whether A hacked B’s email or B sat down and did something logged in as A, it is a security incident that needs to be reported.

It’s not your job to investigate it, but it is your job to document it and report it.

Also, you have an ethical obligation to not share information you may have come across inadvertently while performing your IT support services (except as needed to report the incident through proper channels) and you should not gossip or speculate about what may or may not have been going on.

1
  • 1
    Comments are not for extended discussion; this conversation has been moved to chat. – Neo Jan 19 at 14:24
31

TLDR: Report it as a security violation.

To break it down, there are three violations.

The computer was left on, with the user logged in and unlocked.

In almost every IT security policy, this is a no-no. Your computer should in the very least be locked.

The web browser was left open

Again, leaving browser windows open is usually a violation of most IT security polices.

more specifically in an email with B's latest salary receipt.

This is company information left unsecured. The fact that it's a coworker's salary information is not a mitigating circumstance, but an aggravating one, and again, is likely a violation. Having that information easily accessible due to an unsecured PC with an open webpage should be screaming "potential security breach."

0
16

On one hand, it's not my responsibility to make sure personal email accounts are secure, and I'm also not absolutely sure that there is something nefarious going on or if there was consent.

Explanations for this can be several, like, say, B asking A to use their computer briefly, A leaving the office and asking B to leave it on as you would later check the PC...

Anyways, don't assume or make up things and explanations for this; with that stance one can quickly start feeling "things are odd". Keep doing your work and focus on the task given (the PC).

What you can do without going over your role and responsibilities is to report or tell about this to someone. Telling A is one option, so they are aware that their PC was on and logged in... they can then tell you if it was on purpose or they know nothing about it...

You can then proceed to report this to your manager. Don't phrase it as "hey I saw A's PC being hacked or compromised", as you are not sure if it was on purpose, just stick to the facts (you found A's PC on and with B's user logged in). The email with salaries is also a bit superficial detail, what matters is that you found the PC on and another user logged in.

3
  • "Another used logged in" Was it another user logged in? or was it User A logged in looking at User B's information (somehow)? One could be just using what's perceived as open computers (user B logged in looking at user b's stuff with or without user a's knowledge/permission because... company computer? why not?)... the other could more likely be a "violation" of some sort. – WernerCD Jan 19 at 23:35
  • 1
    @WernerCD check the post and details OP gave for that. A's pc was left on, A logged in, and inside B's email page looking at B's salary receipt – DarkCygnus Jan 19 at 23:43
  • @DarkCyngus I guess you're right... missed that detail. I think I fall into the "Let A, B & Manager(s) know what you found and the let B raise alarms if needs be" camp. Could be "innocent" reasons and the only "real" problem an is unlocked computer... – WernerCD Jan 20 at 4:20
16

Log it -> Tell A & B assuming both knew -> Let them correct you if not

You should first log what you've seen. A left themselves logged in, security risk, with B's emails open, security risk, and payslip open, personal information risk.

Assume that what you saw was through some innocent means, B was checking their emails on A's computer or some such. With your security hat on talk to A and B together - telling them they shouldn't share computers like this and A shouldn't leave the computer on. If A had gained access without consent of B then B can point that out and escalate.

This way you're tackling what is your job, IT security, and providing the information to B to take action if necessary.

5
  • 4
    Yes! This is a good solution that takes the actual problematic part and leaves handling it to the respective employees without forcing them to do anything. – mishan Jan 19 at 10:43
  • 3
    "...talk to A and B together" - is this really the role of the "IT technician"? – MrWhite Jan 19 at 19:09
  • @MrWhite Everywhere I've worked the IT technicians often talk about any security concerns. Sometimes it's an email rather than a chat at your desk but an email would work in this situation too. – Lio Elbammalf Jan 19 at 19:38
  • An alternative is to talk to A's manager, assuming that is the same person as B's manager. Since they have a working relationship with both individuals, they should know the most tactful way to proceed. – employee-X Jan 19 at 20:53
  • 3
    I agree with MrWhite, this is really not something the IT person should be dealing with. I mean yes, it could be a simple misunderstanding, but the potential fall out from this could be as severe as termination if it was actually a major breach of privacy... – Phill Jan 20 at 0:13
10

I cannot believe that there are people suggesting you do nothing about knowing that Employee A has access to Employee B's personal webmail. That approach is highly unethical and potentially problematic for you if there is a future complaint and you are found to have concealed information you knew. From the Company's point of view you were aware of a situation pointing to a possible security threat / dishonest employee and concealed it - if I discovered that as your Manager I would sack you on the spot.

I strongly suggest you speak to your Manager and they should handle it, likely with HR involved. If you are not comfortable with that approach then you need to speak to Employee B to find out of this was known or not before deciding what to do next.

2
  • "Employee A has access to Employee B's personal webmail" - and on what do you base this assumption? – Davor Jan 19 at 15:27
  • 4
    The third paragraph of the question "[A's] computer was left on, with the user logged in and unlocked. The web browser was left open on employee B's personal webmail page, more specifically in an email with B's latest salary receipt." There is an outside chance employee B was using employee A's computer I guess but it's your job to report not investigate. – Alan Dev Jan 19 at 15:34
-3

Other answers deal with the direct question of what to do with the information now that you have it.

One option to avoid similar dilemmas in the future (assuming Windows-based PC) would be NEVER look at the screen before hitting ctrl-alt-delete - focusing on the keyboard and not the screen as you approach. Then all private information will disappear from the screen and you can safely look at it to see whether you've got a login prompt or need to select "switch user" to log in with admin credentials as a separate session (although you'd almost certainly have figured that out before that point even from peripheral vision).

If the user needs to be logged off for your tests, and you haven't already got standing permission to forcibly end the login session in such cases (potentially losing documents the user was still editing etc.), you could simply select the "lock" option (as the user should have done themselves when leaving the workstation unattended), and report back that user did not log out, so you cannot proceed, and/or seek permission from the manager to forcibly log that user out, potentially losing unsaved work. If the manager asks back "what were they in the middle of" you would then be able to honestly reply "I've no idea, the workstation is [now] locked".

It may then still be necessary to report the security incident, but an honest report along the lines of like "user was still logged in on arrival, I immediately locked the workstation without looking at it in order to protect any private information that may have been displayed" would seem a better position to be able to take than, in effect, "On arrival, workstation was unlocked, and I couldn't resist looking at the private information displayed on the screen - and indeed looking at it closely enough to determine that A's computer was logged in to B's private email with B's payslip showing", which is what your original question amounts to.

As others have pointed out, you can't now "unsee" what you saw, and there's a whole separate ethical issue about whether you had permission to check out what A had on their screen on arrival, and whether to admit to the privacy violation you committed if you did not have in fact have (implied) permission to do this, and again I'm not attempting to answer that part.

However, if respect for privacy is important in your environment, you may want to use that approach in the future - and importantly be seen to be doing it routinely when servicing unattended PCs that can be observed by others in the room or in nearby rooms. A "I didn't see what was on the screen because I do this as soon as I arrive" will stand up a lot better if you've been seen doing that on multiple occasions... you'll need to determine the right balance between what needs to be kept private at all costs and what should be noticed and reported at all costs for your particular environment.

3
  • 7
    As a former PC tech myself, I know that PC techs, especially at a company, are one of the front lines of PC security. A tech shouldn't blind themselves to an employee's possible security breaches. That said, a PC tech shouldn't go snooping, but something blatantly left open that looks sketchy should definitely be noticed and reported. – computercarguy Jan 19 at 18:20
  • @computercarguy the norms for whether "respect privacy" or "look out for and report anything unusual" has top priority will vary between countries, cultures and even companies. In some regimes a tech guy in that situation might be chastised for failing to take the opportunity to gather as much information as possible... This answer intentionally focuses on the "respect privacy" end of the spectrum - when approaching an unlocked PC you might reasonably expect private information to have been on the screen and can plan to take steps to avoid inadvertently breaching privacy. – Steve Jan 20 at 10:01
  • ... contd... it had occurred to me when drafting that one explanation (albeit barely plausible) for what the OP saw was a trap/test set up in a very privacy-conscious environment, to make sure that OP follows the specified security/privacy/data protection protocols for instances of this nature (or even to check whether OP was "snooping" enough to notice that the private info was "sketchy"). There are some other great answers that work well in environments where some level of observation and monitoring of potentially private activity is authorised and expected. – Steve Jan 20 at 10:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .