50

I'm in a bit of a predicament. Last week, an e-mail went out to boss and a few others from my e-mail address. It contained a number of rude remarks and strange insults.

Of course, I did NOT send this, and never do something like that. I told my boss as much, and I thought he would just let it go. But today, he contacted me and told me that IT said this e-mail came from my computer. He said he wanted to schedule a meeting to discuss this with me and HR.

Honestly, I'm more irritated than anything that my boss keeps bringing this up (and that he's looping HR into this!). It's clear that he doesn't fully believe me, which is really maddening because I've never done anything to break his trust. I was planning on vehemently denying everything to my boss and HR, but as I've calmed down a bit, I realized I need to have a good approach to discussing this. I don't want to let my anger get the better of me and say something I will regret. But I also want to make it very clear that this e-mail did not come from me.

What can I say (or not say) in this upcoming discussion to insist on my innocence and come off as trustworthy, while remaining professional?

And in case you're wondering, I work from home and am single, so it's not as if a coworker just composed an e-mail while I was stepping away to use the restroom. Now I'm not a computer guy, but this definitely sounds like I've been hacked by someone.

UPDATE

This is going to be the most embarrassing thing I've even written, but here goes...

So after my talk with my boss and HR, they said that this has happened REPEATEDLY for weeks now, and it always happens in the middle of the night. After a less than productive conversation, I went to prove them wrong. So I set up a camera facing my work computer, and then went to sleep. My thinking is that if I could show them that I never touched my computer, it would prove my innocence. (Probably a better way to do this, but I'm not much of a computer guy).

Watching my video the next morning, I see at 3:20am in the morning, somebody does come to my computer: ME. To my shock, I saw myself stumble in the middle of the night, login, and type something, giggle to myself, and then stumble away. I looked at my SENT messages the next morning, and sure enough, there was a juvenile message sent to my boss about how he was a "stupid head".

I have NO memory of this at all. I'm not on any medication, and have never had any issue sleepwalking.

I called my boss this morning, and apologized profusely. I have promised him that I will seek psychiatric help immediately. He didn't really say much, so I don't know what he'll do next. I'm so unbelievably embarrassed right now.

1
  • 1
    Comments are not for extended discussion; this conversation has been moved to chat.
    – DarkCygnus
    Nov 15, 2022 at 18:27

13 Answers 13

78

Since you have no concrete evidence to support your innocence you have to rely on more circumstantial evidence and hope your boss and HR are willing to work to figure out what is actually going on.

Request a copy of the Email in question

You need to know what exactly you are up against, and so if you have not already get a copy of that email with all the information on it that you can. Then look for patterns in it that do not match with how you compose emails or would indicate the person who sent it did not know anything about the people (like if a hacker had done it):

  • Are there people in the To or CC that you never interact with
  • Bad grammar or spelling
  • Incorrect personal information about the people listed (incorrect gender, race, age, or position)
  • Very vague or generic insult and remarks that could be made to or about anyone
  • Was the email sent at a time that you would normally not be on the system, or even better was it at a time you can produce an alibi (like a picture of you at a local sports game when this supposed email went out).

Ask Questions

Has anyone else experienced oddities?

Has IT been keeping up with patching machines, or any known zero-day exploits that could be odd?

Has your account showed you logged in at times you know for a fact you were not logged in (or others for that matter) .

Highlight how amazing you are

Use your character to help prove that you did not do this. Example of things you can highlight during this meeting that can help prove your innocence:

  • How many years you have been with the company without incident.
  • There has been no serious drama or conflict going on between you and those who received the email.
  • You had nothing to gain from this.
  • Oddities with timing. End of the year is normally time for performance reviews, so why would you intentionally sink your performance review for the year by pulling a stunt like this? if there some other major things going on in the workplace that this incident would interfere with point it out and how this email has only made your job harder.

In conclusion though you may be irritated by this, it is important to create the appearance that you want to work with your HR and manager to get to the bottom of this and that you are on their side about all this mess. At the end of the day your manager and HR want to know what happened so that it does not happen again (now how much effort they want to put into figuring it out is a different question), and likewise you to do not want it to be ignored only for a week later another strange email goes out.

11
  • 151
    Request a copy of the Email in question WITH HEADERS. The headers will contain information about where the email originated, what hosts it passed through, which hosts authorized or authenticated it, etc. Look for origins outside your company, or it passing through computers outside your normal host chain (send yourself an email and see what hosts are normal).
    – simpleuser
    Nov 15, 2022 at 7:58
  • 48
    @Hobbamok OP should request a copy of the email with headers anyway - they should be able to see all the evidence against them. It might be that the IT department was sloppy in attributing it to their machine without checking too hard. If OP's machine was hacked, they need as much info as possible to sort that out so that they can make sure it doesn't happen again (if that's the case, the email might be the least of their worries, and they will need to nuke and pave the machine - after any investigation).
    – MadMan
    Nov 15, 2022 at 10:41
  • 21
    Don't exclude the possibility of remote desktop access. In my early IT career we used to take remote control of computers for playing pranks all the time. This sounds like a similar situation that went a bit too far. Nov 15, 2022 at 14:04
  • 30
    Don't exclude the possibility that IT didn't really do too much to check the headers were real. It's possible they didn't or they the person who did check did not understand them. Those headers should contain the entire life of the email, where it started, what is passed though. And if anything is missing from that chain, then the email is bogus.
    – simpleuser
    Nov 15, 2022 at 19:01
  • 5
    Lol stackexchange is such a funny place. @simpleuser said to get the raw email with header data and got 111 upvotes in 18 hours but in security stack exchange people would literally be asking you for your computer type, your router specs, if your company has an email filter software, or a firewall etc which all may have logs to prove your innocence, and they would get like two upvotes. Nov 16, 2022 at 2:54
63

Don't try to convince them you're innocent. You're not a falsely accused victim here : you're a conscientious employee who's found evidence of a security problem. The idea that they think that this is an HR problem is because they haven't yet realised that if, instead, they have an IT problem, that has many more significant implications for the company.

It's definitely worth confirming whether IT have said the e-mail came from your computer (and not just under your login). That suggests they have records of device identifiers - though if they don't the idea that they know it came from your machine may be a misunderstanding. It might be they haven't checked device identifiers, which could show that it wasn't your machine, or that several devices were logged in simultaneously.

Does the e-mail appear in your "sent items"? This isn't conclusive, as it could have been deleted, but is worth knowing (Note : if it does, don't delete it yourself - that would support the idea you were being dishonest). If you can tell people what you were doing at the time the e-mail was sent (or received), this might also give evidence that it couldn't have been you.

But the middle two paragraphs are what you might be able to do in cooperation with your IT department (and letting them see your computer is a good idea - unless one of them is involved). That's not what will be most important to the company : if you didn't send the e-mail, your company has a significant security hole.

Show them that they have a security problem. The idea that you were innocent will follow.

1
  • 1
    Comments are not for extended discussion; this conversation has been moved to chat.
    – DarkCygnus
    Nov 16, 2022 at 19:44
28

Most company emails can be accessed through domain+account+password combos through SMTP or other credentials — this is how you can get your work email on your phone.

This sounds like someone accessed your account, either an internal or external user, malicious or a joker in your company. Ask if there's an access / login log for your email. Or see for yourself if there's been access, here's two popular providers but I'm sure this is available for most providers now:

  • Gmail keeps an activity log in "Details" in the bottom right (click it twice) that contains locations/IPs and Date/Time accessed.
  • Outlook keeps a log under "Recent Activity". Login through outlook.com -> Top right icon (your face) -> View account -> "Devices" or "My sign-ins"
3
  • 16
    This, and also, OP should be aware that this may still come out badly for them if it turns out that the reason someone else had their password was they reused it/wrote it on a post-it note/used something very weak.
    – Clumsy cat
    Nov 15, 2022 at 9:58
  • 6
    In some cases, the attacker doesn't even have to access your account. I have seen companies where I was intern setup the mail system where any valid login allowed sending mails from any from address. They did not consider this a security issue when I reported it after discovering it when I made a mistake configuring my email client
    – Ferrybig
    Nov 15, 2022 at 13:16
  • 2
    In my last workplace (before working from home started) we were supposed to lock our workstations when we left them. One colleague felt entitled, if someone forgot, to compose an email addressed to their boss like 'Dear Ian, I think you are a f***cking bastard' but not click 'send'. I think that if one did get sent, more than one person would have been blamed. Nov 15, 2022 at 22:04
21

Honestly, I'm more irritated than anything

Don't be upset. Something bad happened and the company must investigate this, even if just to determine that they have a security issue (which could be quite serious). They can't just "let it go".

Investigations typically look for "Motive, Means, and Opportunity". Since the message came from your address, you ARE a suspect since you have more opportunity than everyone else (unless you have an alibi, which would be great). There isn't a whole lot you can do about this other than co-operating as much as you can. Give them access to your computer, assure your innocence, etc.

Your strongest defense here is Motive: Only a complete idiot would sent a message like this from their own e-mail address. You have no conflict with anyone in the company and a clean track record. It would make no sense whatsoever for you to do this.

2
  • 1
    Another thing would be writing style. Especially if I want to insult you, my style changes. I could look at the text and say "If I wanted to insult you, I wouldn't have used these words".
    – gnasher729
    Nov 16, 2022 at 0:06
  • 2
    @gnasher729 I'm not sure that's useful. From the employer's perspective, you could have planned that and intentionally changed your writing style for the email.
    – toady_two
    Nov 16, 2022 at 10:21
16

Do you have a carbon monoxide detector? There's a somewhat famous case on reddit of a guy noticing weird behaviour he thought was someone else breaking into his apartment. He was then told to get a CO detector and found out that yes, he was being continuously exposed to dangerous levels, and all the weird behaviour was him doing things that he did not remember afterwards. Very unlikely that it's the same thing in your case, but CO monitors are good to have and it's good to test them and make sure they're working if you already have one.

(Edit based on comments: This is something you should pursue to understand for yourself whether it's a possible cause and then figure out how to use that information if it does turn out to be relevant, not something you should immediately claim)

Other than that, as other have said, get copies of the email source text that was received, and the same from another email that you know you sent to the same address. Even if you're not very technically inclined, you can compare the headers of the two and see if something doesn't match. Email spoofing (faking that an email was sent from a different email address) is quite easy and common, but fairly obvious if you look at the actual headers.

4
  • 9
    The comments to that reddit thread are also full of stories from people who used Ambien and did unusual things they wouldn't remember. So medications are also a thing worth checking.
    – marcelm
    Nov 15, 2022 at 21:38
  • To the OP: whatever you do, do not claim you have any kind of psychosis (induced by CO or anything, even if temporary). you probably were hacked anyway, investigate it further this route. Nov 16, 2022 at 0:16
  • This is definitely a route OP should pursue for OP, but I'd suggest doing this on their own time, and not mentioning it as a possible-anything until hard medical info comes back.
    – Criggie
    Nov 16, 2022 at 7:14
  • This is definitely an answer worth considering. Next door's central heating boiler discharges around my bedroom window so I keep the window closed. OP should try to keep fit and eat well as far as possible. Nov 16, 2022 at 11:33
4

What can I say (or not say) in this upcoming discussion to insist on my innocence and come off as trustworthy, while remaining professional?

If you did not send the email, the only thing you can and should say is "I did not send the email". Nobody here knows if that will be enough to convince them of your innocence, especially if IT is reporting that the email originated from your computer.

You can ask IT to further investigate if your computer has been compromised in some way that would explain the origin of this email, but this assumes that you have a competent IT group that is able and willing to investigate. If that is not the case then at this point I would be polishing up your resume and looking for a new place to work for.

6
  • Thanks, and I suppose you're right. But ugh... I really don't have to look for a new place to work. (It wasn't until this incident that I really had anything negative to say about my company).
    – user137643
    Nov 14, 2022 at 18:41
  • You can also try getting an independent firm to look at your computer to see if there are signs of tampering, if your IT department isn't able to. Make sure you get your company's agreement before you do this. Nov 14, 2022 at 19:52
  • 4
    This isn't a court of law where you should avoid self-incrimination. Simply stating that you didn't send it isn't likely to be enough to save your job. Nov 15, 2022 at 4:58
  • 3
    @gregorycurrie guilty people feel the need to defend themselves, innocent people are straightforward with facts. The easiest way to tell someone is lying is by them feeling the need to come up with elaborate stories and lengthy prepared defenses. Like it or not going into lengthy explanations about how it couldn't have been you because blah blah blah comes across as incredibly guiltily. Of course it's not a court of law but often the same advice applies.
    – eps
    Nov 15, 2022 at 22:07
  • 2
    Asking IT is a good idea, but only after determining that the guilty sender is likely not in IT.
    – donjuedo
    Nov 16, 2022 at 1:23
3

When these things happen, it is not enough to let your boss know and hope the fact is forgotten. There are many ways to send an email pretending to someone else, but you should have taken immediately into account that your computer might have been hacked. Especially when you work from home you cannot take security lightly.

Now you'd better change your passwords and get in touch with the IT people within your company, and ask them to help you and scan your computer. If you are working from a laptop, when you go to the office for a meeting, bring it with you and have it checked.

Then during the meeting with your boss and HR try and understand whether he is more worried about the insults or your approach to security.

5
  • 1
    I'd give you an upvote but I disagree with the last sentence. If I was the boss I'd answer: "I'm concerned with both, because if someone feels free to insult a manager, they would feel free to insult someone else, who may get deeply upset." Nov 15, 2022 at 10:51
  • 3
    @GregoryCurrie I mean that if the boss believed that the author of the question did not write the email then the purpose of the meeting with HR might be to reprimand them for the security issue,
    – FluidCode
    Nov 15, 2022 at 11:00
  • 1
    @FluidCode that is a very good point. Everyone here seems to assume that it's the IT departments fault if the OP's computer was hacked/infected. That is possible but at best it's a 50/50 chance. Experience has taught me most issues are PEBCAK.
    – DRF
    Nov 15, 2022 at 11:44
  • For anyone not knowing the acronym: PEBCAK
    – OldPadawan
    Nov 15, 2022 at 12:09
  • @DRF I did not mean to comment on the security that allowed the computer to be hacked. I know nothing about it. I only mean that a signal of a breach requires immediate action.
    – FluidCode
    Nov 15, 2022 at 14:09
3

Is your company using Microsoft Exchange for email?

Have you traveled recently or used your machine on a public or free WiFi system?

If the company is using AAD (Azure Active Directory) and/or Exchange Online, IT will be able to check the access logs for Exchange to see where the email originated. They can also check your machine's logs for signs of compromise.
If an email was sent from your email client without your knowledge, that means that someone has either gotten control of your machine remotely or has gotten access to your machine in person. Ask for a copy of the mail transfer logs showing that the message originated from your email client on your computer and was sent to the email server directly. Ask for a copy of the email message with FULL headers.

There are several ways that this could happen. Malicious actors do not generally do this to send insulting emails. They do it for financial gain.

Do you have any enemies that might benefit by making you look bad?

3

If this is a large-ish company, there should be a separate security function. Open a formal security incident, write down all the relevant facts and state that you suspect that your account has been accessed by someone unauthorized. If you can, talk to someone at infosec informally as well and reiterate that you suspect that there is an ongoing security incident. Make sure you don't sound like you're primarily concerned about your boss being mad at you but the security of the company's data.

At this point, even if they don't believe you, they'll probably take this seriously, because if you're right and something important goes next, they'll be in trouble. Then you can go back to your boss and point to the incident ticket (that infosec is investigating it should give some credibility right away) and hopefully at the end there will be an investigation report that fully absolves you.

1

Your IT department might be able to see when you were logged into your computer. This could be from any VPN your may need to access your company's intranet or other sources.

If the email was sent outside of your normal work hours, it should be evident when you were actually logged in or not. And if it was sent outside of your normal working hours, you may be able to show them an alibi, such as having been out for a meal, running errands, or whatever.

Even if it was sent during work hours, you may still be able to show them you were away from the computer at lunch, bathroom break, or something. This may be more difficult, but there should still be a record of when your computer was locked.

This alibi may not completely relieve you from all suspicion, but it can at least throw some suspicion back on the timing of the email.

Also, it's natural to be upset about this situation, however, you also have to realize that your manager may not have any choice in what they are doing. It might be company policy to investigate any and all instances of what appear to be workplace harassment. And that likely includes talking to HR and possibly lawyers, in the event there's even the possibility of a lawsuit coming from this incident.

If this email's insults were directed at you, wouldn't you want them to investigate it? It's likely that the people targeted by the email's content are as upset as you, maybe more.

It's not in your best interest to get in the way of this investigation or to complain about it. What's best is to cooperate with it and trying to prove your innocence. Unfortunately, this isn't a court room where they have to prove your guilt, but they already have some proof that you are guilty, so you have to work against that, too.

Speaking as someone who worked as a computer tech for 15 years and as a software developer for 10 years, IT isn't foolproof. They/we do make mistakes, even following trails of evidence to an expected conclusion instead of following it to it's actual end results.

0

Let's say your work computer stays in your office when you go home for the day (or weekend). If you use Google apps, you may have a detailed location history. I know I did, until I discovered it and ultimately decided to turn that off.

So if you have that history and it shows you nowhere near the computer at the time the email is time-stamped to have been sent, BAM! you're in the clear.

I have been in a very similar situation at work (long ago) and worked hard to find evidence to clear my name, and succeeded. Based on that experience, I'd say someone who has something mean to say, but under someone else's name, is not so likely to be more clever than to wait until you're away and use your not-yet-locked PC to get the email out.

It could be done with Remote Desktop, but less likely, and if so, there may be logs of who connected and when.

0

Now I'm not a computer guy

... and therefore you will not be able to have a coherent discussion regarding the "what could have happened part".

Depending on your company and country, you may be in very limited trouble (when you discuss they will magically believe you and not their IT) or a candidate for firing.

I believe you first need to understand what they want and to which point they are ready to accept your point of view.

If I was in your case, I would have come with three tomes of documentation and 76 scenarios of what went wrong. And a dozen of recommendations for improvement.
The difference is that I am a "computer guy" and therefore can imagine and then explain with any level of details why it was not me.

I think a reasonable way to deal with that would be for you to

  • talk with a competent "computer guy", as you call him (CG)
  • based on that gather the information CG needs to actually see what is going on. It may be very easy (the headers on the email show that it is not you) or very difficult (you need access to logs that you do not have). This is basically redoing the work of the IT team, and proving them wrong. This doe snot end well, usually.
  • go to the discussion with this information - you have someone the upper hand then because they need to ingest factual data you provided them.
0

A lot of reasonable answers and suggestions. I add one thing thing that I don't see and relevant in case you work from an office.

Do you lock your workstation when you go to the bathroom or to take coffee or whatever? Maybe somebody used your computer to send that email.

There is a similar story in a comment somewhere above from Michael Harvey.

Maybe you can suggest them to look at the security cameras at the time email was sent to see if somebody else used your computer while you were away.

P.S. good to ask a colleague that received the email originally to print it for you including headers and time received to make sure it was not tampered with later.