32

Yes, these questions/answers are related but do not answer my question.


I work in a company that, to my understanding, handles very sensitive information on its network. The open space in which I am currently located accommodates roughly 20 people at most.

Since I arrived at my desk, I see some colleagues' computers unlocked for up to 30 minutes on a daily basis. This behaviour seems highly unprofessional and is, I think, a significant security vulnerability.  So far, I have gone up to these unlocked computers multiple times to lock them via the ⊞ Win+L combination.

In an effort to bring awareness to one of the "worst offenders", I decided to leave a sticky note one evening on the keyboard of his (then unlocked for 20 minutes) laptop warning him that his computer wasn't locked and that he could remediate this by using ⊞ Win+L.  I must note that I wrote the message as factually as possible to avoid any interpretation.


For a bit of context:

  • I am a fairly new employee (of a few months). I do not have the authority to enforce any kind of donut/breakfast policy nor do I think it would be welcome or useful.
  • All our computers are equipped with a card reader which encrypts the computer drives. Removing the card from the reader automatically locks the computer.
  • When I wrote the note (or more generally when I interact with my colleagues' computers), there is either no one around to stop me, or no one actually questions me.
  • Again, security in our company is, according to our security officer, a major topic and should be enforced as well as possible.
  • The sticky note is now on a pen holder, but the computers are still regularly left unlocked and unmonitored.

Questions:

  • Was I unprofessional when leaving the note the way I did?
  • Alternatively, is it okay for me to lock computers that aren't mine?
  • Should I bring the issue up so that it is addressed by people with the right authority/knowledge? If possible, I'd like to avoid people getting in trouble.

Update:
I got in touch with one of my colleagues in charge of security/data protection. She told me that I should lock unattended computers when possible. In addition, she mentioned that I can discuss the matter with coworkers who aren't very careful about their laptop's security. Apparently, my bringing the issue up will lead to a reminder e-mail being sent to everyone.


To answer my own questions:
The note, while not exactly unprofessional, isn't the ideal way to convey the message. I do believe bringing the issue to the attention of my coworker was the right thing to do, but it might've been better to talk to him directly.
In my case, locking the computers is the right thing to do.
However, given the points made in the answers and comments, I strongly recommend not touching anything and contacting your manager and/or the person in charge of cybersecurity instead. They'll know how to handle the situation correctly.

7
  • 1
    Comments have been moved to chat; please do not continue the discussion here. Before posting a comment below this one, please review the purposes of comments. Comments that do not request clarification or suggest improvements usually belong as an answer, on The Workplace Meta, or in The Workplace Chat. Comments continuing discussion may be removed.
    – motosubatsu
    Commented May 4, 2023 at 19:56
  • 2
    Is the computer physically accessible to untrusted employees or members of the public?
    – Aaron F
    Commented May 4, 2023 at 21:10
  • 1
    Do you have an infosec team that you can make aware of the problem so that they can coordinate efforts to solve it?
    – Jason C
    Commented May 4, 2023 at 21:44
  • 1
    @z3ro - Why did you submit your answer as an edit to your question?
    – Donald
    Commented May 5, 2023 at 3:08
  • 3
    Rather than editing your answer into the question, you should post it as a self-answer to the question instead.
    – V2Blast
    Commented May 5, 2023 at 18:51

13 Answers 13

62

I have worked in cybersecurity for 9 years and am currently in a management position.

What you are doing is only a band aid solution, temporarily addressing the symptoms rather than root cause: bypassing the proximity cards, used as a technical access control.

Was your conduct here unprofessional?

No, as long as your intent was right and that locking of unsecured endpoints was the only action you took.

Should you escalate the issue to security officer and management?

In my opinion working in cybersecurity, yes.

Good cybersecurity requires a community effort and holding each other accountable is a part of that effort. Moreover, a problematic security culture often does not get remediated until sufficient data exists to verify its truly a problem. Proactive employee reporting and suggestions play a big role to ensuring problem culture is noticed.

Now, the most important question you did not ask in my opinion: How can problematic behavior be curbed in future?

Assuming behavior of leaving endpoints unlocked is not deliberately malicious, employee security awareness training is key. Employees need to know why unlocked endpoints are a security risk in order to practice the desired behavior. Suggesting to security management renewed efforts in awareness training would be my recommendation.

  • Data loss and exfiltration
  • Loss of nonrepudiation in security audit logs
  • Unauthorized access to sensitive data and potential subsequent misuse of such data
29
  • 12
    if i see anyone tempering with my laptop (locked or unlocked) i would challenge and report them immediately. specially from new employees Commented May 4, 2023 at 9:01
  • 7
    If it requires manual intervention, it's not reliable. The company should set up a group policy for automatically locking idle computers. Commented May 4, 2023 at 12:09
  • 18
    @BЈовић And where I work security would then spend 3 hours asking you why your computer was left unlocked so that a new employee could tamper with your computer... It would end up with a write up and you would be required to go thru the new employee security seminar. And then the new employee would get a thank you for being vigilant...
    – Questor
    Commented May 4, 2023 at 16:31
  • 10
    @Wastrel Cybersecurity/good security practices are everyone's job... The "It's not my job" mentality is why we see large companies get hacked again, and again... Because someone who thinks that security is someone else job left a big f*** hole in the system because of their bad practices. Cybersecurity is everyone's job, and it only takes one differently abled individual who thinks otherwise to compromise your entire system.
    – Questor
    Commented May 4, 2023 at 16:33
  • 8
    @BЈовић your laptop? It's the company's laptop, not yours. Unless it is, in which case: why are you using your personal laptop at work?
    – Aaron F
    Commented May 4, 2023 at 21:12
45

Was I unprofessional when leaving the note the way I did? Alternatively, is it okay for me to lock computers that aren't mine?

Tampering with other employees' computers/work area without their knowledge or consent for an apparent policy violation that you are not personally responsible for is unprofessional even if you believe that it is for a good reason.

Should I bring the issue up so that it is adressed by people with the right authority/knowledge? If possible, I'd like to avoid people getting in trouble.

Yes, you should bring it up to the security officer if security is indeed that important in your company. You will very quickly discover how important security actually is based on their follow up to your report and what actions they take. If other employees get in trouble, that is solely on them for not following what is supposedly a very important company policy.

19
  • 14
    Side note: "is unprofessional" is somewhat an understatement... "I mistakenly left my computer unlocked and I noticed someone left note 'Lock you PC! With care, Bob'... now contract with XYZ contains an extra clause which I definitely not put there" (or anything along those lines) would get you in hot water or even legal trouble (like potential access to private info/health data/stock price related info). Just don't do that - tell that person or indeed start with manager/security officer. Commented May 3, 2023 at 18:01
  • 6
    "Yes, you should bring it up to the security officer if security is indeed that important in your company." And, since you are new to the company, make sure to bring it up as a question, not as a report or a complaint. It is up to them to decide whether this is worth worrying about, not you.
    – Heinzi
    Commented May 4, 2023 at 4:48
  • 2
    I did not realize that tampering with someone's workstation, even to prevent security breaches, could result in me getting in trouble. I'm getting my manager's input asap to resolve the matter and to have further info on the correct way to handle it in the future.
    – z3r0
    Commented May 4, 2023 at 6:46
  • 25
    Locking an unlocked computer isn't tampering, it's preventing tampering. That's a huge difference. And if the company requires it, then it's not a problem of consent, since it's the company's computer, not the employee's computer, even if the employee is the main user. And leaving a message about locking a computer for security reason isn't tampering, either, at least not anymore than leaving a message about someone calling their desk or saying they have a package at the front desk. Commented May 4, 2023 at 17:20
  • 4
    @AlexeiLevenkov Arguably, "all I did was locking an unlocked computer" would be a pretty solid legal defense for Bob. The only evidence against him would be the sticky note that he left, and the defense would not be refuted by it. Commented May 5, 2023 at 11:26
30

I work in a company with sensitive military data.

Every company has its own culture about such issues, so what is considered professional or not can be wildly different. So that one is kind of tricky to answer.

For example: If somebody here leaves the room without locking the PC, it's kind of a tradition to use his unlocked account to open Notepad alerting him that he forgot to lock his PC with a date behind it. After that locking their PC, so nobody else can get to it. (The date is a date on which he has to treat the entire office on pie/cake as punishment for forgetting).

When it comes to "is it okay for me to lock computers that aren't mine?" if security is a high issue in the company then yes, but only after you did a small callout asking whose PC this is if you don't know it yourself...no response? Then the PC is unattended and should be locked.

The people in charge of such security have a lot on their plate, so bringing every small issue to their attention is a major strain on their time. So I would avoid it and talk to the person who made the mistake instead. (Of course do alert security when there is malicious intent like phishing, theft and so on.)

7
  • 4
    If the OP noticed that many people leave their computers unlocked for long periods everyday, then it's maybe not a small issue.
    – Stef
    Commented May 4, 2023 at 8:10
  • 11
    I recall hearing of a company (I forgot which one) that set up a dedicated Slack channel, such that if you manage to post to that channel from another user's account via any means, that person whose account you accessed has to bring a cake. I don't know how effective it was for them, but I like this idea of adding a fun social aspect to basic red-teaming.
    – yoniLavi
    Commented May 4, 2023 at 12:50
  • 3
    The problem with "feel free to use an unlocked computer to open notepad or slack" is that it allows people to work on other peoples computers, making it easier to peek at confidential information while having an excuse ready. Best not to do that. If you must, WIN+L should be enough. Heck, turning off the screen might be.
    – Konerak
    Commented May 4, 2023 at 13:41
  • 8
    @yoniLavi - in the days before instant messaging if we found someone on our team left their screen unlocked we'd use their email client to send a message to the rest of the team along the lines of "donuts are on me". Either that, or screenshot their desktop, minimise all their apps and set the picture as their wallpaper then watch for them to come back and use their "apps". People only forgot to lock their screen once or twice :-)
    – mclayton
    Commented May 4, 2023 at 14:24
  • 2
    Pre-covid at my company if you left your station unlocked, a coworker would post as you in chat, "I like baggy pants." Everyone knew what that meant, and you would be slightly embarrassed and the brief subject of some good-natured ribbing. That wouldn't fly in all work cultures, though. Commented May 4, 2023 at 18:40
28

I understand your desire to do the right thing for your company. But when you state that

I am a fairly new employee (of a few months)

Should I bring the issue up so that it is addressed by people with the right authority/knowledge?

Then the first person you should be looking to for guidance is your immediate manager. They should be the one who knows how security issues should be addressed—either by agreeing with what you have done, or by supporting your desire to escalate this to security.

If your manager doesn't want to deal with this issue (for example, by saying things like "don't touch other peoples computers", or "it's really not a problem") then you could escalate it yourself to either a manager in IT/security or your manager's manager. Note however, if your manager doesn't want to deal with the issue, then going around them could be a "career-limiting move", resulting in you having to freshen up your resume.

I'd like to avoid people getting in trouble.

People have already broken the rules. They are the ones who will be responsible for getting themselves into trouble. You are just a witness to their "crimes".

4
  • 6
    Depending on the environment, the OP may be responsible as well. Data protection is everyone's job. Some places would get him in trouble as well if he noticed but didn't say or do anything.
    – TarHalda
    Commented May 3, 2023 at 14:32
  • 3
    @TarHalda That's why the first step is for the OP to speak to their manager. It's either to get the issue actually fixed, or a CYA move to protect the OP.
    – Peter M
    Commented May 3, 2023 at 14:35
  • 1
    I left a computer unlocked and someone changed one of my files in what they thought was an amusing way..... worse things have happened, someone sent an email from the account of someone's unlocked computer claiming they were leaving to take up work with an unsavory organization (that was named). SO, the post-it-note could be seen as 'nice'; still there can be problems, as noted by others, this is typically not well received. Commented May 4, 2023 at 14:14
  • @TarHalda If you notice and don't say or do anything because your manager told you not to say or do anything, it's now his problem. (If falling a little ballsy, get that in email writing from your manager and CC it to the security guy) Commented May 4, 2023 at 21:51
10

You're acting on your feelings instead of company policy.

What you've said is indeed concerning, but you've failed to bring up the only important question: what does the company policy say about this?

Nothing else matters.

Was I unprofessional when leaving the note the way I did?

Yes, highly - because you did something instead of finding out if it could be done.

Alternatively, is it okay for me to lock computers that aren't mine?

It depends if the policy allows it. If it doesn't, in the worst case scenario, someone could try to push it as a criminal act. E.g. here where I live, there's "accessing a computer system by unauthorized person" law. Yeah, you've only locked it, but had that constituted "access"? Lawyers would love to argue.

Should I bring the issue up so that it is adressed by people with the right authority/knowledge? If possible, I'd like to avoid people getting in trouble.

What you should do is to find out if this is an issue at all.

Ask the people with the right authority what's the policy on leaving workstations unlocked. If the policy is getting broken on a daily basis, then bring up the issue of people leaving computers unlocked. If there's no policy, then bring up the issue of having no policy. If there is a very lenient policy, then bring up the issue of having a potential vulnerability.

At this point, you don't even know WHAT is the issue, and yet you're already fixing it.

I would focus more on leaving smartcards in the reader. Because locking is of no purpose if a mean to unlock is left in place. I know that smartcards usually come with passwords, but passwords with smartcards are usually weaker, because people trust smartcard providing the security. So smartcards unattended + weak passwords = locking pointless.

9

I would not go around locking other peoples' PCs. If the security aspect concerns you, you should say it to the security officer, and it is up to them to institute policies and enforce them.

On the other hand, by taking it upon yourself

  • You are leaving yourself open to accusations if something happens to a colleague's PC and you were seen "messing with it".

  • It's probably unlikely but there may have been a reason a specific PC was left unlocked.

  • It could be considered bad manners. Although technically all the computers are owned by the Company and not the employees, people can still get upset or resentful of others messing with their stuff without permission, even if it's "for their own good" as it were.

5
  • 1
    Bad advice for companies that deal with sensitive information (Health, Finance, Government) which require that computers be locked when not in use... And yes people forget to do it all of the time.
    – Questor
    Commented May 5, 2023 at 18:19
  • At a previous workplace, the director of engineering walked by a colleague's computer and saw it unlocked. She had gone to the toilet. He called sysadmin, asked them to change her password and when she returned and was unable to login, they made her go through the process of raising a ticket to reset her password, as a lesson to never leave her computer unlocked.
    – Nav
    Commented May 6, 2023 at 12:12
  • 2
    @Questor - Why is it bad advice? Surely it is the job of the people in charge of security to enforce this, not the OP. Unless there is a specific policy in the company that employees should lock other people's computers if they see them unlocked.
    – komodosp
    Commented May 8, 2023 at 10:13
  • @komodosp " security in our company is, according to our security officer, a major topic and should be enforced as best as possible." Enforced as best as possible means not leaving a computer unlocked. Which leaves you (the person who saw the unlocked computer) 2 options. A) sit there until the person who left their computer unlocked comes back so that the computer is not accessible to anyone who walks by.. B) lock it so that you can get back to work.
    – Questor
    Commented May 8, 2023 at 16:59
  • Penetration testers love* people who leave their computer unlocked... And they love people who think that security is not their problem... Cybersecurity is everyone's problem. A company is as secure as the least security conscience person who works there.
    – Questor
    Commented May 8, 2023 at 17:01
7

The answer is really easy: You ask your manager what to do. And you do what he tells you to do. If you believe that your managers answer is a security risk, you ask the next person whose business is security.

Whatever you do because you just decided to do it and without any policy in place could get you into trouble. You don’t know what the consequences of your actions are, how they could be (mis)interpreted, and what the damages are.

Let’s say A forgets to lock his computer. Next day A notices that information has been stolen or destroyed. Security is called and I tell them that you sat down at A’s computer and started typing.

1
  • 2
    The first 2 paragraphs are fine, but the 3rd is simply a non-starter. First, you don't have to "sit down and start typing" to lock a computer. It's literally 2 or 4 buttons on the keyboard. And missing data could happen at any time, including before the OP locked the computer. I've had data go missing on a computer I was working on because of defective programs, so blaming it on a person isn't guaranteed. If the company does a real investigation and looks at cameras, no problem. If the accused gets summarily fired w/o an investigation, I probably wouldn't want to keep that job, anyway. Commented May 5, 2023 at 17:08
6

To add to the answers:

In one company I worked at, if you left your PC unlocked, someone would jump on it, send an email to all-staff with something mildly inflammatory and amusing. You typically only saw someone forgot to do it once or twice before the lesson was learned.

To answer your questions(s):

Was I unprofessional when leaving the note the way I did?

Some could view it as passive-aggressive and also there is a risk of 'This new upstart, what does he know?' - and whether it's unprofessional depends on your company culture to a large degree. However, as someone who works in IT - if your data is that sensitive, culture and passive-aggressiveness be damned.

Alternatively, is it okay for me to lock computers that aren't mine?

I would advise against this in a general sense. Firstly, it's creating a risk for you—if someone sees you at another's PC 'doing something' and then there's an issue—guess who is going to be the culprit?

In addition, it fosters an attitude of 'I don't need to worry about locking my PC—z3r0 will do it for me!' - which is very very bad.

Should I bring the issue up so that it is addressed by people with the right authority/knowledge? If possible, I'd like to avoid people getting in trouble.

Yes. You absolutely should bring up that issue—don't mention names—but do mention frequency and time exposed. Locking a PC when you are going to, say, a water cooler for 20 seconds and you still have visual confirmation of your PC is one thing, going off for lunch for 20 minutes is completely different.

However, if management is still not taking the issue seriously, you may need to talk with your IT team about it. One possibility would be to do a 'proof of concept' for management (with approval of IT of course) where by you get secure information from an unlocked PC to an insecure source, e.g., printing it out to show how critical this vulnerability is.

This is a high-risk endeavour though, and you'll need multiple layers of CYA emails.

6
  • I remember back at university when we were working on a programming project. A classmate of me left the computer unlocked when he left. I added an alias in his .bashrc to let cd do echo "FATAL ERROR: Directory corrupted." or something like that. Probably not recommended in a more serious workplace setting , but was kind of fun back in school.... :-) (was reminded of this by the similar, "send mail to all staff" occurence that you mentioned.
    – Alderath
    Commented May 4, 2023 at 8:58
  • 1
    A friend of mine works in a company where a computer left unlocked invariably sends "I buy the pizza tonight" to all-office mailing address. Pizza for ~10 people may get expensive. Repeat offenders buy beer as well.
    – fraxinus
    Commented May 4, 2023 at 12:08
  • 1
    I worked for a software house in the early 00's. Unlocked machines were a constant issue. We had many reminders, threats and mandatory training, but it was still a problem. The solution came from a bit of a joker who opened email on any unlocked machine, and posted "Thank you for your lovely email but I don't have the same feelings for you" to the rest of the team. (Not to all email users). Or "there are big dogs on the loose on the floor here, please call security". Others felt the need for revenge and retaliated. Soon everyone locked all the time. Not professional but it worked 100% . Commented May 4, 2023 at 14:08
  • 2
    What’s amusing to some people can be offensive to others this seems like a horrible idea.
    – Donald
    Commented May 5, 2023 at 3:02
  • Just here to say that if I forgot to lock my computer and someone used it to send a supposedly funny email from my account, I would absolutely do my best to get them fired. Knowingly using someone else's account is a crime where I live. Do remind me to lock it, and if I'm a repeat offender, do make me buy pizza or whatever (if that punishment has been agreed upon by the team, of course), but DO NOT take the liberty to impersonate me, even for the sake of a joke.
    – laszlok
    Commented May 8, 2023 at 14:17
5

My guess is that you are pretty new not only at this job, but in office work as well. Here are a few things to keep in mind, and a recommendation on what to do.

All companies have very sensitive information on their network. What information it is differs; it could be anything from their business idea and prices to defence information. For the individual company both of these are very sensitive information.

Your company doesn't worry about security. If they were, people wouldn't leave their computers without locking them. Sure they say they worry about security, but if the culture isn't one of security they really don't care that much.

Security officers always worries about security. That's their job. And when someone asks them about security they love to talk about it, and to suggest their interpretation of security. But the security officer isn't the company; it's only one person employed by the company.

I'm not saying any of the above is good or bad. I just want to make you aware of the things above.

Now for how you should handle it. I understand that you are aware of security, and that's a good thing. And you want to do what's right, another good thing. But you should think about your priorities. Your first priority should be to keep the job and get a good reference. Second is to get along with your coworkers. Third is to do your job. Or maybe second and third is the other way around. But you have no priority at all to manage other people or meddling in what they do.

In your situation I would send an email to your closest manager mentioning you have seen people not lock their computers, and asking what the rules are. Don't mention names. Then follow the rules yourself and don't worry about what other people do.

4

Your company surely has someone in the role of CISO (chief information security officer).

This person needs to be informed factually, e.g. "Hey $CISO, I often notice laptops which are unlocked for 30 minutes in the office."

You do not need to, and actually should not do anything else.

The CISO will take appropriate steps with the necessary authority. They could make your IT personnel configure mandatory screen locking (i.e., screens could lock after 1 minute of non-usage, or whatever time they decide). They could dispatch some security person to randomly go through the office and jot down the offending laptops for personal interventional measures. And so on and forth. Or they could decide that the status quo is not relevant either.

1
  • +1 for pointing out this could be solved by an individual with the capabilities to do so, if an unlocked computer for 30 minutes or 2 minutes was a problem, it could be prevented.
    – Donald
    Commented May 5, 2023 at 3:04
3

In a workplace that takes these things reasonably seriously, and if you've had a period of training where this kind of security was emphasised, then I don't think you've "overstepped".

What I mean by taking seriously is that if a local manager (not necessarily just the "security officer") saw an unlocked computer abandoned by its user, there would be something said.

However I would avoid chastising anyone with significantly more service than you, at a time when you only have a few months' service.

If there is a large (or unknown) disparity in experience, then it would be better to either let a manager judge the situation and the workplace norms, or (if there is no question of their likely opinion) then at least let them mediate the message.

Sometimes in some workplaces, staff may have seen a large number of different practices over the years, and may already be habituated to something less stringent, and the business has to balance the benefit to security against the cost of hassling experienced workers.

From the perspective of the business, long-serving staff may also be well-known quantities, and therefore if their terminal is misused, there may be far less ambiguity about their innocence than if a changing cast of trainees sitting close to each other habitually have access to each others' terminals.

It may seem strange, but I suspect the main risk of mischief is from those who misuse their own terminals but claim someone else did it, rather than the risk being from those who actually misuse the terminals of others.

2

I got in touch with one of my colleagues in charge of security/data protection. She told me that I should lock unattended computers when possible. In addition, she mentioned that I can discuss the matter with coworkers who aren't very careful about their laptop's security.

LOL, what?! Report her for not doing her job and offloading it on someone else.

STOP your actions immediately, stop pestering people, and focus on your actual job duties. The security/data officer doesn't care enough about the situation to be proactive. If they cared then they would implement an auto-lock after 5-10 minutes of inactivity.

Here's the jist of it. Don't touch other people's stuff, no one likes that and you won't be liked; career suicide is in your future.

It doesn't matter how noble your intentions are. Just wait till the day someone's stuff gets messed up due to something unrelated to Win+L and someone exclaims "Yeah, that weird new guy keeps going around touching people's computers." It doesn't matter if you did something wrong or not, this is the reputation which you have actively decided to build.

On a more serious note, one small slip and you miss the L and actually do trigger something destructive, now what?

5
  • 2
    Stay in your lane!
    – tomjedrz
    Commented May 4, 2023 at 16:36
  • 4
    "Yeah, that weird new guy keeps going around touching people's computers." Really? It seems as if the appropriate response to that would be "I talked to [my colleague in charge of security/data protection] and she said to lock unattended computers when possible. I've even talked to my coworkers about their lack of concern for security and they still don't lock their computers." That will completely change the conversation in any business with any kind of concern for security, especially if it's company policy to lock computers when you leave them. Commented May 4, 2023 at 17:35
  • If I caught someone who wasn’t authorized around my machine at my desk, locked or unlocked, I would report their activity to the IT Administrator…
    – Donald
    Commented May 5, 2023 at 3:06
  • 1
    @MonkeyZeus, yes, I worked with people, even customers, on a regular basis for 30+ years before the pandemic. Quite often I was the tech guy reminding people of security policy, which included locking any computer they walked past. I definitely know how often locking doesn't happen, and how often people complain "it's too hard". Other times I was being told that by managers monthly, if not weekly, in team meetings. I've even worked a DoD contract where leaving a computer unlocked could cost you your job, because (by default) it was a threat to national security. Commented May 5, 2023 at 16:44
  • And security people aren't supposed to go around monitoring everyone's computers for them being locked. They definitely should talk to the manager of the offender, but having the OP talk to the employee first give the security person the guilt the other employee with "even the new guy is more security conscious than you." Using guilt doesn't always work, but that shouldn't be the only method for discipline, either. Commented May 5, 2023 at 16:46
1

You personally might not be able to institute this policy but as a suggestion to your manager you could propose the following.

  • If someone leaves their computer unlocked
  • And someone else manages to send an email from that computer to the manager informing them of this
  • The offender has to buy the team doughnuts.

It's a lighthearted way of reminding people of what is actually a very serious issue and people are more likely to actually engage with this system of reporting if the result is that they get doughnuts.

A more heavy-handed policy of taking people down the disciplinary route if they forget to lock their computer is going to disincentivize people from engaging with reporting because they don't want to get their colleagues in significant trouble for what amounts to a very easy to make mistake.

The sending of the email also makes them realise "oh shit, they could've sent something far worse and it would've looked as though it came from me... Best not do that again".


As for your actual question, nah, that's perfectly reasonable.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .