How to convince workplace I'm innocent [closed]

Question

I'm in a bit of a predicament. Last week, an e-mail went out to boss and a few others from my e-mail address. It contained a number of rude remarks and strange insults.

Of course, I did NOT send this, and never do something like that. I told my boss as much, and I thought he would just let it go. But today, he contacted me and told me that IT said this e-mail came from my computer. He said he wanted to schedule a meeting to discuss this with me and HR.

Honestly, I'm more irritated than anything that my boss keeps bringing this up (and that he's looping HR into this!). It's clear that he doesn't fully believe me, which is really maddening because I've never done anything to break his trust. I was planning on vehemently denying everything to my boss and HR, but as I've calmed down a bit, I realized I need to have a good approach to discussing this. I don't want to let my anger get the better of me and say something I will regret. But I also want to make it very clear that this e-mail did not come from me.

What can I say (or not say) in this upcoming discussion to insist on my innocence and come off as trustworthy, while remaining professional?

And in case you're wondering, I work from home and am single, so it's not as if a coworker just composed an e-mail while I was stepping away to use the restroom. Now I'm not a computer guy, but this definitely sounds like I've been hacked by someone.

UPDATE

This is going to be the most embarrassing thing I've even written, but here goes...

So after my talk with my boss and HR, they said that this has happened REPEATEDLY for weeks now, and it always happens in the middle of the night. After a less than productive conversation, I went to prove them wrong. So I set up a camera facing my work computer, and then went to sleep. My thinking is that if I could show them that I never touched my computer, it would prove my innocence. (Probably a better way to do this, but I'm not much of a computer guy).

Watching my video the next morning, I see at 3:20am in the morning, somebody does come to my computer: ME. To my shock, I saw myself stumble in the middle of the night, login, and type something, giggle to myself, and then stumble away. I looked at my SENT messages the next morning, and sure enough, there was a juvenile message sent to my boss about how he was a "stupid head".

I have NO memory of this at all. I'm not on any medication, and have never had any issue sleepwalking.

I called my boss this morning, and apologized profusely. I have promised him that I will seek psychiatric help immediately. He didn't really say much, so I don't know what he'll do next. I'm so unbelievably embarrassed right now.

Answer 1

Since you have no concrete evidence to support your innocence you have to rely on more circumstantial evidence and hope your boss and HR are willing to work to figure out what is actually going on.

Request a copy of the Email in question

You need to know what exactly you are up against, and so if you have not already get a copy of that email with all the information on it that you can. Then look for patterns in it that do not match with how you compose emails or would indicate the person who sent it did not know anything about the people (like if a hacker had done it):

• Are there people in the To or CC that you never interact with
• Bad grammar or spelling
• Incorrect personal information about the people listed (incorrect gender, race, age, or position)
• Very vague or generic insult and remarks that could be made to or about anyone
• Was the email sent at a time that you would normally not be on the system, or even better was it at a time you can produce an alibi (like a picture of you at a local sports game when this supposed email went out).

Ask Questions

Has anyone else experienced oddities?

Has IT been keeping up with patching machines, or any known zero-day exploits that could be odd?

Has your account showed you logged in at times you know for a fact you were not logged in (or others for that matter) .

Highlight how amazing you are

Use your character to help prove that you did not do this. Example of things you can highlight during this meeting that can help prove your innocence:

• How many years you have been with the company without incident.
• There has been no serious drama or conflict going on between you and those who received the email.
• You had nothing to gain from this.
• Oddities with timing. End of the year is normally time for performance reviews, so why would you intentionally sink your performance review for the year by pulling a stunt like this? if there some other major things going on in the workplace that this incident would interfere with point it out and how this email has only made your job harder.

In conclusion though you may be irritated by this, it is important to create the appearance that you want to work with your HR and manager to get to the bottom of this and that you are on their side about all this mess. At the end of the day your manager and HR want to know what happened so that it does not happen again (now how much effort they want to put into figuring it out is a different question), and likewise you to do not want it to be ignored only for a week later another strange email goes out.

Answer 2

Don't try to convince them you're innocent. You're not a falsely accused victim here : you're a conscientious employee who's found evidence of a security problem. The idea that they think that this is an HR problem is because they haven't yet realised that if, instead, they have an IT problem, that has many more significant implications for the company.

It's definitely worth confirming whether IT have said the e-mail came from your computer (and not just under your login). That suggests they have records of device identifiers - though if they don't the idea that they know it came from your machine may be a misunderstanding. It might be they haven't checked device identifiers, which could show that it wasn't your machine, or that several devices were logged in simultaneously.

Does the e-mail appear in your "sent items"? This isn't conclusive, as it could have been deleted, but is worth knowing (Note : if it does, don't delete it yourself - that would support the idea you were being dishonest). If you can tell people what you were doing at the time the e-mail was sent (or received), this might also give evidence that it couldn't have been you.

But the middle two paragraphs are what you might be able to do in cooperation with your IT department (and letting them see your computer is a good idea - unless one of them is involved). That's not what will be most important to the company : if you didn't send the e-mail, your company has a significant security hole.

Show them that they have a security problem. The idea that you were innocent will follow.

Answer 3

Most company emails can be accessed through domain+account+password combos through SMTP or other credentials — this is how you can get your work email on your phone.

This sounds like someone accessed your account, either an internal or external user, malicious or a joker in your company. Ask if there's an access / login log for your email. Or see for yourself if there's been access, here's two popular providers but I'm sure this is available for most providers now:

• Gmail keeps an activity log in "Details" in the bottom right (click it twice) that contains locations/IPs and Date/Time accessed.
• Outlook keeps a log under "Recent Activity". Login through outlook.com -> Top right icon (your face) -> View account -> "Devices" or "My sign-ins"

Answer 4

Honestly, I'm more irritated than anything

Don't be upset. Something bad happened and the company must investigate this, even if just to determine that they have a security issue (which could be quite serious). They can't just "let it go".

Investigations typically look for "Motive, Means, and Opportunity". Since the message came from your address, you ARE a suspect since you have more opportunity than everyone else (unless you have an alibi, which would be great). There isn't a whole lot you can do about this other than co-operating as much as you can. Give them access to your computer, assure your innocence, etc.

Your strongest defense here is Motive: Only a complete idiot would sent a message like this from their own e-mail address. You have no conflict with anyone in the company and a clean track record. It would make no sense whatsoever for you to do this.

Answer 5

Do you have a carbon monoxide detector? There's a somewhat famous case on reddit of a guy noticing weird behaviour he thought was someone else breaking into his apartment. He was then told to get a CO detector and found out that yes, he was being continuously exposed to dangerous levels, and all the weird behaviour was him doing things that he did not remember afterwards. Very unlikely that it's the same thing in your case, but CO monitors are good to have and it's good to test them and make sure they're working if you already have one.

(Edit based on comments: This is something you should pursue to understand for yourself whether it's a possible cause and then figure out how to use that information if it does turn out to be relevant, not something you should immediately claim)

Other than that, as other have said, get copies of the email source text that was received, and the same from another email that you know you sent to the same address. Even if you're not very technically inclined, you can compare the headers of the two and see if something doesn't match. Email spoofing (faking that an email was sent from a different email address) is quite easy and common, but fairly obvious if you look at the actual headers.

Answer 6

What can I say (or not say) in this upcoming discussion to insist on my innocence and come off as trustworthy, while remaining professional?

If you did not send the email, the only thing you can and should say is "I did not send the email". Nobody here knows if that will be enough to convince them of your innocence, especially if IT is reporting that the email originated from your computer.

You can ask IT to further investigate if your computer has been compromised in some way that would explain the origin of this email, but this assumes that you have a competent IT group that is able and willing to investigate. If that is not the case then at this point I would be polishing up your resume and looking for a new place to work for.

Answer 7

When these things happen, it is not enough to let your boss know and hope the fact is forgotten. There are many ways to send an email pretending to someone else, but you should have taken immediately into account that your computer might have been hacked. Especially when you work from home you cannot take security lightly.

Now you'd better change your passwords and get in touch with the IT people within your company, and ask them to help you and scan your computer. If you are working from a laptop, when you go to the office for a meeting, bring it with you and have it checked.

Then during the meeting with your boss and HR try and understand whether he is more worried about the insults or your approach to security.

Answer 8

Is your company using Microsoft Exchange for email?

Have you traveled recently or used your machine on a public or free WiFi system?

If the company is using AAD (Azure Active Directory) and/or Exchange Online, IT will be able to check the access logs for Exchange to see where the email originated. They can also check your machine's logs for signs of compromise.
If an email was sent from your email client without your knowledge, that means that someone has either gotten control of your machine remotely or has gotten access to your machine in person. Ask for a copy of the mail transfer logs showing that the message originated from your email client on your computer and was sent to the email server directly. Ask for a copy of the email message with FULL headers.

There are several ways that this could happen. Malicious actors do not generally do this to send insulting emails. They do it for financial gain.

Do you have any enemies that might benefit by making you look bad?

Answer 9

If this is a large-ish company, there should be a separate security function. Open a formal security incident, write down all the relevant facts and state that you suspect that your account has been accessed by someone unauthorized. If you can, talk to someone at infosec informally as well and reiterate that you suspect that there is an ongoing security incident. Make sure you don't sound like you're primarily concerned about your boss being mad at you but the security of the company's data.

At this point, even if they don't believe you, they'll probably take this seriously, because if you're right and something important goes next, they'll be in trouble. Then you can go back to your boss and point to the incident ticket (that infosec is investigating it should give some credibility right away) and hopefully at the end there will be an investigation report that fully absolves you.

Answer 10

Your IT department might be able to see when you were logged into your computer. This could be from any VPN your may need to access your company's intranet or other sources.

If the email was sent outside of your normal work hours, it should be evident when you were actually logged in or not. And if it was sent outside of your normal working hours, you may be able to show them an alibi, such as having been out for a meal, running errands, or whatever.

Even if it was sent during work hours, you may still be able to show them you were away from the computer at lunch, bathroom break, or something. This may be more difficult, but there should still be a record of when your computer was locked.

This alibi may not completely relieve you from all suspicion, but it can at least throw some suspicion back on the timing of the email.

Also, it's natural to be upset about this situation, however, you also have to realize that your manager may not have any choice in what they are doing. It might be company policy to investigate any and all instances of what appear to be workplace harassment. And that likely includes talking to HR and possibly lawyers, in the event there's even the possibility of a lawsuit coming from this incident.

If this email's insults were directed at you, wouldn't you want them to investigate it? It's likely that the people targeted by the email's content are as upset as you, maybe more.

It's not in your best interest to get in the way of this investigation or to complain about it. What's best is to cooperate with it and trying to prove your innocence. Unfortunately, this isn't a court room where they have to prove your guilt, but they already have some proof that you are guilty, so you have to work against that, too.

Speaking as someone who worked as a computer tech for 15 years and as a software developer for 10 years, IT isn't foolproof. They/we do make mistakes, even following trails of evidence to an expected conclusion instead of following it to it's actual end results.

Answer 11

Let's say your work computer stays in your office when you go home for the day (or weekend). If you use Google apps, you may have a detailed location history. I know I did, until I discovered it and ultimately decided to turn that off.

So if you have that history and it shows you nowhere near the computer at the time the email is time-stamped to have been sent, BAM! you're in the clear.

I have been in a very similar situation at work (long ago) and worked hard to find evidence to clear my name, and succeeded. Based on that experience, I'd say someone who has something mean to say, but under someone else's name, is not so likely to be more clever than to wait until you're away and use your not-yet-locked PC to get the email out.

It could be done with Remote Desktop, but less likely, and if so, there may be logs of who connected and when.

Answer 12

Now I'm not a computer guy

... and therefore you will not be able to have a coherent discussion regarding the "what could have happened part".

Depending on your company and country, you may be in very limited trouble (when you discuss they will magically believe you and not their IT) or a candidate for firing.

I believe you first need to understand what they want and to which point they are ready to accept your point of view.

If I was in your case, I would have come with three tomes of documentation and 76 scenarios of what went wrong. And a dozen of recommendations for improvement.
The difference is that I am a "computer guy" and therefore can imagine and then explain with any level of details why it was not me.

I think a reasonable way to deal with that would be for you to

• talk with a competent "computer guy", as you call him (CG)
• based on that gather the information CG needs to actually see what is going on. It may be very easy (the headers on the email show that it is not you) or very difficult (you need access to logs that you do not have). This is basically redoing the work of the IT team, and proving them wrong. This doe snot end well, usually.
• go to the discussion with this information - you have someone the upper hand then because they need to ingest factual data you provided them.

Answer 13

A lot of reasonable answers and suggestions. I add one thing thing that I don't see and relevant in case you work from an office.

Do you lock your workstation when you go to the bathroom or to take coffee or whatever? Maybe somebody used your computer to send that email.

There is a similar story in a comment somewhere above from Michael Harvey.

Maybe you can suggest them to look at the security cameras at the time email was sent to see if somebody else used your computer while you were away.

P.S. good to ask a colleague that received the email originally to print it for you including headers and time received to make sure it was not tampered with later.