Wrongfully accused of lending my security badge to another employee

Question

I work in the cybersecurity division of my employer, in a lead role for close to 9 years.

Two days ago, I was working late patching and monitoring our systems as a result of a security incident that came out over the weekend. I also just happened to forget my regular access badge at home, that had elevated access to all securied areas, so had to get a temporary access badge programmed with access to sensitive building areas that only security team folks have access to , such as the server rooms.

When I left on Monday, the front desk reception people had already left. Having there being no one to check in my badge and almost no other folks at office, I left my temp badge at reception (which in hindsight is bad) I did not want to be accused of not returning company equipment so did not bring badge home that day with me.

Apparently someone else took the temp badge I returned before reception could check it in and reset the associated physical access. Yesterday, the new borrower of the temp badge returned it, having used it. The problem though, is the badge still shows in the system as having me as the registered / authorized user, not the new borrower.

Today, I got an unpleasant email from security divusion management , cc' my manager and HR, falsely assuming I had lent my temporary badge to this other person. Lending of / deliberate misuse of access credentials is strictly disallowed by company policy and can be reason for summary dismissal. Even worse, due to role in security division, expectations to follow policy is higher than for non info security folks

Addenum

After review of electronic badge system access logs, I now know the identity of the person who took the access badge. I am also now able to definitively say the other person did not access any areas he was not authorized to access using my credentials. Finally, server room access logs and security cameras footage did not show unauthorized access to the room.

Update: How this turned out was I got a formal warning and my company believed it was indeed accidental , caused by confusion rather than malice. My proactiveness in reviewing logs and surveillance cameras helped my defense. So far , there has been no demotion or other job consequences outside of formal warning.

How do I minimize damage as a result of the false accusation?

I also see a system weakness in that expectations are unclear in return of badges during non working hours. Should this issue be raised when I respond?

Answer 1

First, take the blame. Explain exactly what you did wrong. Explain how stupid it was for you to do that. If you start off by saying that the accusation is false, then they won't even listen to what you have to say afterward (even if what you say is technically correct).

Send out that email now. Do not wait. Even if you figured out that the server room wasn't compromised, they still need to know the exact details of what happened. But please, don't start off by saying that you were "wrongly accused". In my personal opinion, what you did was actually worse, security-wise, than lending out your badge to someone else.

In your case, by leaving your badge in an unsecured location, you essentially gave your badge to a perfect stranger (that at the time at least, you didn't even know the identity of). And objectively, that is actually worse than lending out your badge to a trusted individual (although both options are really bad either way).

So explain what you did, but don't try to use it as an excuse. If it starts sounding like an excuse, then an argument will ensue, and if an argument ensues, it's not going to go your way, for the reasons I've already outlined in my previous paragraph.

Also, there is nothing more infuriating than talking to someone who tries to prove you wrong over a small inconsequential technicality. On one hand, it's like the person you're speaking to can't even seem to see the forest from the trees. But on the other hand, it's like that person is trying to prove you wrong, in a futile attempt to challenge you and get power over you.

And yes, depending on the type of employer you working for, you could be fired over the security incident itself. But in my opinion, arguing this minor point now, that's the surest and quickest way to get yourself fired, even if they had no intention to fire you in the first place.

I also see a system weakness in that expectations are unclear in return of badges during non working hours. Should this issue be raised when I respond?

No, you can raise this issue later, if you see that the signage/process has not changed at the reception. Raising it now will send the wrong message.

Answer 2

You DID hand your badge to another person, whether you intended to or not.

How that person got access to your badge is irrelevant, unless they stole it from your body or otherwise forced you to hand it over without them being authorised to do so.

Live up to your error, admit it, and accept the consequences. You can only hope it's not something you will get fired over, though in my experience (which is based on reading the rules in quite a few companies, never breaking them) is that a first offense will likely cause a negative mark on your performance review and possibly temporary revocation of privileges (meaning you won't be able to enter secured areas alone for a while).

You made a (stupid) mistake, admit it and don't try to hide the fact. Worse, you hiding the fact as long as you did already may well be taken far worse than you making the mistake in the first place.

Answer 3

You're in trouble, and it's in your best interests to clear things up now.

There are 2 points that you need to address in your first response:

1. This was an accident, you did not lend your badge, you left it in an insecure area.
2. The lack of due procedure to return temporary badges may lead to further such accidents.

I disagree with answers advising to just be "passive" about it; clarifying the intent is primordial, in my own view, as there is a massive difference between consciously breaking the rules and accidentally breaking the rules -- even if in this case the accident may have worst consequences.

The difficulty is in finding the right phrasing. You do need to take responsibility, and you do not want to appear to be making excuses or to appear to be shifting the blame.

Still, despite the difficulty, it's in your best interest to address the above 2 points.

Hence I would suggest a response in 5 parts:

1. Clarify your intent: you did not intentionally lend your badge to another, you made the mistake of leaving your badge in an insecure area instead.
2. Own it up. It was a mistake. Apologize, promise not to do it again, etc... Make it sincere, and not over long.
3. Show your recovery actions. As soon as you were pointed your mistake, you took explicit steps to ensure that no unauthorized access occurred from it.
4. Suggest improvements to the temporary-badge return procedure in the case of absence of authorized personnel at reception. The locked drop-box is a really nifty idea, the other is clarifying that should the drop-box be open the company would rather employees keep the temporary-badge with them until it can securely be returned.
5. Don't end on the suggestion -- it could be perceived as blame-shifting -- and instead put a one-liner reiterating that you own up to your mistake and will endeavor to ensure that it won't happen again.

These 5 parts contain the 2 important points -- clarification and concrete suggestion -- while ensuring that people do see you taking responsibility for your mistake, and driving the company forward.

I hope for you that your company favors blameless post-mortem to the hot potato game, and showing that you are reactive (reacting upon being notified) and proactive (taking steps to handle the immediate threats, and being thoughtful about systematically preventing re-occurrences rather than hoping) will hopefully help fixing the dent in your credibility.

Answer 4

How do I minimize damage as a result of the false accusation?

Explain that this was poor judgment on your part, that you understand the potential ramifications and consequences, and that it won't happen again.

I also see a system weakness in that expectations are unclear in return of badges during non working hours. Should this issue be raised when I respond?

You should address this issue in your response, as it's related to why you did what you did. Ask what the policy is in this scenario and ask that it be published with the rest of the guidelines and policies.

Answer 5

Let's face it. You've made a bad mistake, which is completely unreasonable for someone in your position to make. If you are not fired, it's likely the company has significant issues that need to be addressed around permissible standards of behaviour, and it's likely that there needs to be policy changes so mistakes like this in the future are met with terminations.

You should get on the front foot and explain exactly what happened, how your behaviour was fundamentally flawed, and the potential remedies that they could take (excluding firing you.)

Because you are a lead in the cybersecurity division, you are able to see the potential remedies for such a situation. You should suggest that you undertake the most onerous of trainings available. And you should be very eager to undertake them.

Depending on employment law in your jurisdiction, if you are fired, you may be better off asking if you can resign rather than be fired.

And, as a side note, you justification for leaving your pass in reception doesn't make a lot of sense. You should have absolutely taken the pass home. Without justifying your own behaviour, you could suggest improvements to policy to ensure no other employee is unsure what to do in such a situation.

Answer 6

I left my temp badge at reception

Great, now prove to me that this was not a malice plot; aka, prove a negative. Good luck...

---

Even worse, due to role in security division, expectations to follow policy is higher than for non info security folks

No kidding...

---

How do I minimize damage as a result of the false accusation?

The accusation seems legitimate, actually.

Have you had a chance to explain yourself or is this accusation a "one-way street"?

---

I also see a system weakness in that expectations are unclear in return of badges during non working hours. Should this issue be raised when I respond?

Are you trying to get immediately terminated and escorted by security?

Might as well try to accuse the front desk people checking in badges as being the true system weakness. Hint, don't do this.

The only weakness is that the expectations were unclear to you; this part you can mention and request clarification. If they cannot readily produce clarification then it will become apparent that there could be some missing instruction but as a 9-year cybersecurity employee you are expected to use sound judgement at all times.

Answer 7

Personally I would take the middle ground between these answers. simply respond with the facts. No 'apologies' or 'defense' just "I did not give the badge to {other employee.} I left the badge in reception as I left on Monday night at {time}, I can only assume someone re-issued the badge without resetting the owner'

Simple, gets your side of the story in, and doesn't admit any blame.

Answer 8

Do not admit anything, defend yourself, it is not your fault

First of all, you had to work late at night. Unless you started original mess, you basically had to clean up for someone else mistakes, and is no wonder you forgot your own badge. Situation is akin to calling doctor in an emergency from his home, and than complaining because he did not bring his white coat.

Then you had to do what you did with temporary badge. Again, it is not your fault reception was not working. Nor it was the fault of people working there, it is an organizational flaw. Also, you are not to blame if someone stole temporary badge from reception, or if guys working at reception did not check access rights of said badge before handing it to someone else.

Finally, no harm has been done. Person who got the badge after you did not do any damage.

My personal hunch is that somebody tries to scapegoat you for the original incident and for the all organizational flaws with reception, system of badge access. As they say that attack is a best defense, they are now attacking you for something that was their job to do. I would retaliate in kind, would gather evidence of their wrongdoing and present them to higher management if they insist on these accusations. In the whole affair your only mistakes was not bringing your badge from home, which is minor, especially if you were being called in an emergency late at night.

Also, depending on your locale and employment laws (hiring and firing at will or not) you could talk with some lawyer about your options. In any case, do not admit anything, do not sign anything, do not voluntarily leave your job unless you find some other position.