-2

When I left the office one day and forgot to lock my computer, a colleague said out loud to 2 other employees in the office, something to the effect of: “What is he watching on his computer?”

The 2 employees who were not in my department, not in IT, and not my manager, came over to my work computer and accessed the tabs at the top of my browser to see what they could find.

They did not have my permission to access my computer and their access was not business related.

Is this OK from a legal standpoint? How about ethically?

5
  • 2
    Have you checked your contract? It may well be specified that you are responsible to control access to your computer at all times - like locking the screen when going for a pee or cigarette break. If you push to HR etc then you might be considered at fault.
    – Solar Mike
    Commented May 21 at 5:17
  • 2
    On a side note: If you raise this issue with your aboves you might find out that this could backfire since you might have violated the commonly enforced Clear Desk Policy defined in ISO/IEC 27001 yourself. That doesn't justify the behaviour of the two employees mentioned, but just keep that in mind when trying to address this situation..
    – iLuvLogix
    Commented May 21 at 12:35
  • 4
    You learned two things. 1.) You work with morons 2.) You should lock your screen when you get up.
    – DogBoy37
    Commented May 21 at 12:41
  • Given the possible outcomes of complaining: "Never invoke what thou canst not banish."
    – keshlam
    Commented May 21 at 14:34
  • 5
    Were you still in earshot when this happened? If so, it might have been intended as a joke to make you aware that you forgot the lock your computer, and what consequence of that could be. Also, did those co-workers actually look, or just act as if they looked? Commented May 21 at 15:46

4 Answers 4

10

In the words of the Late, Great R. Lee Ermy:

Private Pyle, if there is one thing in this world that I hate, it is a unlocked footlocker, you know that, don't you?!

If it wasn't for ... like you, there wouldn't be any thievery in this world, would there?!

In short - if you left it unlocked, your right to complain is somewhat nullified.

Now - onto the Workplace side of things:

  • At many jobs I have had, there were rules about touching other peoples computers, there was also rules about not leaving computers unlocked - one such company had a tradition where an unlocked Computer would send a company wide email with something mildly insulting - so the person who failed to lock their PC learnt a valuable lesson.

To answer your direct question: From a Legal standpoint - although IANAL - you would likely be laughed out of court if you tried anything.

From an Ethical standpoint - much the same.

To answer the more broad question: The rules in most workplaces about not using others equipment is to guard against malicious actors. e.g. Some employee trying to scam the company or clients and using someone elses device to do so.

And you'll note the choice of verbiage: Malicious. Without Malice in the actions - you likely have no leg to stand on.

Now, depending on your managements views, you could absolutely raise this - but if I were a manager - the first question I would ask was 'Why was your workstation unlocked?' - and then subject both yourself and the other people to an extensive presentation on Cyber Security.

In short: Legal - Hell no. Ethical - Hell no. Without Malice, you have no real leg to stand on - my Best advise - is to take this as the hard lesson that I outlined above at my old work: If you leave your computer unlocked and someone messes with it, it's your fault for leaving it unlocked.

1
5

Is this OK from a legal standpoint?

As always, the answer to this question depends on where you are and which laws apply to you. In the United Kingdom you could argue that this would be in breach of the Computer Misuse Act, as it was unauthorised access. If they viewed any personal data, it might also be an incident under GDPR which could then potentially be reportable to the ICO. If you work with classified data, it could be a notifiable breach. But of course, the laws in your country may vary.

It's possibly also a breach of their employment contracts - but this depends on the specifics of the contract.

How about ethically?

It's certainly impolite, as they're knowingly intruding on your privacy. But then you have no real expectation of privacy on a work-owned computer, and shouldn't be logged in to anything like your personal email.


So in short, you're both in the wrong here. You shouldn't have left a computer unlocked and unattended (which is probably against your organisations policies), and they shouldn't have gone snooping through it.

But thinking practically, it's not really in either of your interests to take this further. If you report their actions, you're admitting that you caused a security incident by leaving your workstation unattended, and potentially cause a whole load of headaches for yourself (or the company).

Take it as lesson going forward to always lock your computer when you step away from it, and be thankful that the people who found it unlocked didn't do anything malicious to it.

2
  • 3
    “you have no real expectation of privacy on a work-owned computer” — I think this is worth highlighting.  While it's easy to think of it as your computer, it belongs to the company, and the company has the final say regarding it.
    – gidds
    Commented May 21 at 22:09
  • However, your nosy colleagues are not "the company".
    – gnasher729
    Commented May 23 at 12:46
2

Your coworkers' action may be considered "crossing the line of office etiquette" at most companies.

But, the word "ethically" (as you wrote) would not likely be applied in this type of scenarios.


Generally, the answer depends on the culture at your company.

At some companies, it may be OK or fun for coworkers to play a prank on an employee, who forgets to lock his computer, as long as the prank is harmless. I have seen many situations like that described in many questions and answers here on this website.

However, at other companies, the manager may have a chat, discussion or warning to those who intentionally open and look at files or folders inside other people's unlocked computers.

If you wish, you can ask your manager for more info.

1
  • 4
    I've seen organisations where if you left your workstation unlocked and unattended, someone would send an email to your team offering to buy them all a round of drinks or a crate of beer. People quickly learned not to leave their workstations unlocked..
    – Gh0stFish
    Commented May 21 at 10:46
2

Unethical in most businesses unless they were directed to do so by someone with authority to make that decision -- your manager or the company security department. But this is likely to get closed as "details are company specific, ask your manager."

If you don't want casual drive-by snooping, learn to lock your machine when not in use. That probably won't stop the IT department or security folks.

If you are concerned about people seeing what you are doing in the machine, don't use the work machine to do it. When using the company's hardware you have limited, if any, privacy guarantees.

If you must do something embarrassing, do it from your own device, on your own network service, and on a secure network possibly including a VPN. And preferably on your own time, not the company's.

Not the answer you're looking for? Browse other questions tagged .